Minimizing or disabling json Syntax Highlighting automatically

[noahdietrich]

Hello,

I have a dataset that consists of json data (using the _json sourcetype), where each event has about 30 fields and is correctly formatted and parsed by Splunk. When i do a basic search to view these events, each event shows the entire json event with syntax highlighting, taking up 30 lines of screen real-estate. I can manually minimize the json for a single event by clicking the [-] sign next to the event, or i can click "show as raw text" to fold up the event into one line, but i'd like this to be automatic for all my events.

Does anyone know if this is possible?

Essentially i can only see one event at a time, because the event shows the entire event's json (all 30 lines). I'm attaching a screenshot of what i mean here:

thank you
Noah

[niketn]

@noahdietrich, Pipe table command to your search

<yourCurrentSearch>
| table _time _raw

Also Event Viewer also has an option on top to change from default List view to Raw or Table view. This setting can also be applied by default using Role based UI Preference through ui-prefs.conf.