I have a dataset that consists of json data (using the _json sourcetype), where each event has about 30 fields and is correctly formatted and parsed by Splunk. When i do a basic search to view these events, each event shows the entire json event with syntax highlighting, taking up 30 lines of screen real-estate. I can manually minimize the json for a single event by clicking the [-] sign next to the event, or i can click "show as raw text" to fold up the event into one line, but i'd like this to be automatic for all my events.
Does anyone know if this is possible?
Essentially i can only see one event at a time, because the event shows the entire event's json (all 30 lines). I'm attaching a screenshot of what i mean here: