named field for indexed data

[gekoner]

I am looking to setup a dashboard that displays data from various indexes. I was looking to just use a data table or event listing. Very Simple layout.
I have the data being returned in the search, but I can't get the contents of the data to display. I'm using "| table _time ..." to sort the data
I think this is because there is no field name for the data. I have tried using _raw but that doesn't work. I can get any of the named fields to display, but what is the correct way to get the data from the event to show the data as it is shown in the raw search. It is all on one line.

EXAMPLE of text returned in the search:
50102:{0x10C} [AUDIT] user.a@email.net - User activated on the server 1234
host=servername sourcetype=APP1 source=F:\Program Files (x86)\APP1\log0001.txt

I know this is simple, I just can't find the correct information on it.

[mw · Accepted solution]

If you want to use an Event Listing to just list out the raw events, you shouldn't have the "| table" stuff. Just use the search that shows properly in the flashtimeline and set the element to Event Listing.

[mw]

Using table will put it in a table. If you just want the raw events, maybe trying using "... | rex mode=sed ..." to keep only what you want.

[gekoner]

mw, I should have been more specific. The reason I was using |table was I wanted to parse the output to only display some of the line. I think the best thing to do is use a regex value in the search parameter.