Splunk 5 -> Unable to view event list

[lpolo]

Unable to switch from table to event list in Splunk 5. Query example:

sourcetype=any |stats count by x    
OR    
sourcetype=any |table a b c

Is this intentional in Splunk 5?

Thanks,
Lp

[RicoSuave]

Hello lpolo,
The flashtimeline now has a button on the upper right side where you can select three different modes for searching: fast, smart, and verbose. Anything other than verbose will not allow you to click the events viewer since the raw events will not be available. This is by design, and partially, why fast and smart are able to return results very quickly. So select verbose, and you should now be able to click on events list.

more info here

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Changethesearchmode

Directly from that page:

Under the Fast mode you'll only see event lists and see event timelines for searches that do not include reporting commands.

[RicoSuave]

Please accept the answer

[lpolo]

Thanks. Worked.