The view you are showing is Splunk's raw event view - your example does not have an event as such, as it's constructed with makeresults and I don't believe you can leverage the event view without a real event It is possible with real events inside a dashboard with the event visualisation, but I don't believe it's possible with constructed data - or for that matter with data from a lookup with inputlookup as that does not generate true events. If you really needed this, I suspect you could construct your test data, then 'collect' it to an index and then search it with another search from that index. ... View more