topic Re: Show all lines for Windows event-log events in Getting Data In

Show all lines for Windows event-log events

chris_brown_ral — Fri, 12 Jun 2015 17:01:27 GMT

For Windows event-log events, Splunk displays the first 5 lines followed by "Show all [n] lines". Most of the time, the good stuff is in the [n] lines, which leads to lots of clicking and expansion. For example, a single event looks like:

06/12/2015 11:54:10 AM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Show all 12 lines

Is the "show all" threshold configurable, or is there a way to alter the events themselves to be single-line, something like...

06/12/2015 11:54:10 AM
LogName=System, SourceName=Microsoft-Windows-Service Control Manager, EventCode=7036, EventType=4
etc.

Re: Show all lines for Windows event-log events

woodcock — Fri, 12 Jun 2015 17:08:05 GMT

I don't know the answer but you can convert to a table as a work around:

... | stats values(_raw) by _time

The performance is TERRIBLE, though.

Re: Show all lines for Windows event-log events

landen99 — Thu, 19 Nov 2015 14:18:35 GMT

Directly above the data and below the timeline (on the Event tab and beneath tab with the word "Visualization") there is a "Format" Option where you can set "Max Lines" to "All lines"