Using events lists

Add an events list to a dashboard to give users access to the events, fields, and values generated by a search. An events list does not abstract or process search results like a chart or other visualization does.

Generate an events list

The content in an events list depends on the search that you run. There are no additional data format requirements.

Prerequisites
Review Configuration options.

Steps

1. From the Search page, run a search.
2. Select the Events tab to view the events list.
3. (Optional) Select Save As > Dashboard panel to add the events list to a dashboard.
4. (Optional) Use the Format menu or Simple XML to configure the events list.

Configuration options

Use the Format menu to configure one or more of the following events list components. You can also adjust these components and make additional configurations using Simple XML.

Display and format options

Use the following settings to adjust events list appearance.

• Choose an events display option.
  • List (default): Show timestamps for each event separately.
  • Raw: Show raw events.
  • Table: Display events as a table. This format is different from the Statistics table visualization.
• Configure row numbers, wrapping, and maximum lines

Drilldown

Use the drilldown editor and/or Simple XML to enable and configure drilldown on an events list. See Use drilldown for dashboard interactivity for more details on enabling and configuring drilldown.

When configuring drilldown on an events list in Simple XML, you can specify one of the following drilldown settings to provide different segment selection options.

Drilldown setting	Segmenting option enabled for users	Example
Full	Select a major segment or one or more contiguous minor segments. The first example shows a minor segment selection. The second example shows a major segment selection.
Inner	Select a single minor segment.
Outer	Select a complete major segment.
None	Disables drilldown (default)

Note: Event segmentation processing for events with long single lines of text can cause browser performance issues.

For more details, see Types of event segmentation in the Knowledge Manager Manual.

Use case scenario

An admin uses an events list to give users access to recent notable system events. To generate the events list, the admin runs the following search.

error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )

The admin adds the events list to a dashboard tracking system status. Dashboard users can click on event fields or a timestamp in the list to open a search using the clicked content.

For example, clicking on the /opt/splunktest/var/log/splunk/metrics.log source value in an event opens the following search in a new window.

index=_internal source="/opt/splunktest/var/log/splunk/metrics.log"