Show all lines for Windows event-log events

[chris_brown_ral]

For Windows event-log events, Splunk displays the first 5 lines followed by "Show all [n] lines". Most of the time, the good stuff is in the [n] lines, which leads to lots of clicking and expansion. For example, a single event looks like:

06/12/2015 11:54:10 AM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Show all 12 lines

Is the "show all" threshold configurable, or is there a way to alter the events themselves to be single-line, something like...

06/12/2015 11:54:10 AM
LogName=System, SourceName=Microsoft-Windows-Service Control Manager, EventCode=7036, EventType=4
etc.

[landen99 · Accepted solution]

Directly above the data and below the timeline (on the Event tab and beneath tab with the word "Visualization") there is a "Format" Option where you can set "Max Lines" to "All lines"

[woodcock]

I don't know the answer but you can convert to a table as a work around:

... | stats values(_raw) by _time

The performance is TERRIBLE, though.