Getting Data In

Minimizing or disabling json Syntax Highlighting automatically



I have a dataset that consists of json data (using the _json sourcetype), where each event has about 30 fields and is correctly formatted and parsed by Splunk. When i do a basic search to view these events, each event shows the entire json event with syntax highlighting, taking up 30 lines of screen real-estate. I can manually minimize the json for a single event by clicking the [-] sign next to the event, or i can click "show as raw text" to fold up the event into one line, but i'd like this to be automatic for all my events.

Does anyone know if this is possible?

Essentially i can only see one event at a time, because the event shows the entire event's json (all 30 lines). I'm attaching a screenshot of what i mean here:

alt text

thank you


@noahdietrich, Pipe table command to your search

| table _time _raw

Also Event Viewer also has an option on top to change from default List view to Raw or Table view. This setting can also be applied by default using Role based UI Preference through ui-prefs.conf.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...