I have many events as the following in my search:
All fields are collapsed at the beginning and I have to unfold every single field by clicking on the little blue "+" (In the screenshot I aleady clicked on the "+".). You can I get all field unfold directly at the beginning so I don't have to click on every "+"?
Thanks in advance.
If you just want to list all the fields getting extracted, then you can use the fieldsummary
command
https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Fieldsummary
Or if the question is to expand the event view please refer below URL