Splunk Classic Dashboard Event Panel Table Visualization

[lcguilfoil]

I am creating a Classic Dashboard. I have a Events Panel that is in the Table format. The headers for the table are the following events: _time, host, source, and sourcetype. These are the "Selected Fields". However, there are other fields that I would like to include as "Selected" so that they show up on the header. Is there anyway to do that?

<panel>
	<event>
		<search>
			<query>index=*</query>
			<earliest>$global_time.earliest$</earliest>
			<latest>$global_time.latest$</latest>
		</search>
		<option name="type">table</option>
	</event>
</panel>

[ITWhisperer]

Try using the table command in your query

index=* | table _time, host, source, sourcetype, otherfield1, otherfield2

[lcguilfoil]

Hello! Thank you for your response. I tried that. However, the Selected Field headers are still just _time, host, source, and sourcetype. The footer Event Fields that appear when I expand the event do include the fields that I put in the table command (ex: Level, Details, etc), but don't appear as the headers or the Selected Fields.

[lcguilfoil · Accepted solution]

I figured it out! I added the fields:

<panel>
	<event>
		<search>
			<query>index=*</query>
			<earliest>$global_time.earliest$</earliest>
			<latest>$global_time.latest$</latest>
		</search>
		<fields>field, field2, field3</fields>
		<option name="type">table</option>
	</event>
</panel>