See my comments in other places in this discussion, which I've tested up to version 7.3.1. ... View more

Create a search that shows the events you're interested in, e.g., maybe it's just source=/var/log/file.log , or source=*whatever.log | head 500 . The search should have a real-time time range. From the actions menu, select "Add to dashboard". Add the search to a new dashboard. Edit the dashboard's View XML, using the event panel as a reference. You won't be able to remove the timestamp or change the spacing or typeface from here. Some things will require an edit of the CSS behind this view. If you prefer, use @Mackenzie's technique of picking out the _raw field and display the results with the <table> panel rather than the <event> panel. You can edit the prefs of this in the view XML as well. ... View more

For info, I've found a way to avoid giving access to _internal to the user. It is probably possible to run a scheduled search on the _internal index and save the result in a summary accessible by the user. I've found another way using metadata available to the users with "|dbinspect". You require 2 searches, one which is scheduled and saves at regular intervals (like every hour) the "|dbinspect" output. Another one which computes the growth of the buckets and doesn't take into account buckets which are removed. source="First_scheduled_search_name" | eval MB = rawSize / 1024 / 1024 | sort +id +_time | streamstats current=f window=1 global=f first(rawSize) as prevRawSize | streamstats current=f window=1 global=f first(id) as prevId | eval diff=if(id == prevId, (rawSize - prevRawSize) / 1024 / 1024, "NOK") | timechart span=1d sum(diff) AS MB_indexed ... View more