Splunk Search

How to expand the count field and show all the events as a search result?

jyab6z
Path Finder

There is my search result in the attached image.

What I want to do is to expand the count field and show all events as my search result. Simply the same function if clicking the count value and choose "View Events".

Is this possible?

alt text

0 Karma
1 Solution

DMohn
Motivator

If you want to have all raw events in your results table as well, you can simply include this in your stats command. Just add a list(_raw) as RawEvents to the already existing SPL, which powers the shown search. Just be aware, that this might enlarge your results table quite a bit 🙂

View solution in original post

0 Karma

DMohn
Motivator

If you want to have all raw events in your results table as well, you can simply include this in your stats command. Just add a list(_raw) as RawEvents to the already existing SPL, which powers the shown search. Just be aware, that this might enlarge your results table quite a bit 🙂

0 Karma

jyab6z
Path Finder

Hi @DMohn,

Thank you for your tips!
Solved my problem with appendcols command.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...