Building on richgalloway's answer, but making in more specific for people like me who are still confused by field management. To SHOW the first 300 characters of the raw search output, I found two options. To show shortened lines in raw form: ... | eval _raw=substr(_raw, 1, 300) To show shortened lines in table form: ... | eval x=substr(_raw, 1, 300) | table x ... View more