I've created a dashboard for searching and filtering events, and it consists of two panels for presenting the results: a table to show a summary of the events based on search criteria, columns are: Time, CorrelationId, Service Name, Log Level, and Message, which are shared attributes among all events an Events panel to show the entirety of an event, which includes attributes that are specific to an event and are not shared with other events, e.g. Stack Trace for errors the table's drilldown is set to "row", and when a row is clicked it sets some tokens that are used to search again to find that event and show it on the Events panel. My goal is to avoid the second search, because the event is already retrieved by the table panel. I've tried passing _raw from table panel to events panel and use makeresults but that command creates a table row and can only be viewed under Statistics/Table tab and does not show anything when Events/List tab is selected. What I need is to view the event in the format that is shown in the screenshot below: I know that renaming a JSON to _raw will deserialize it, but that requires a result-set of events to begin with, e.g.       * | head 1 | eval tmp="{\"key\":\"value\"}" | rename tmp as _raw       will show the new JSON instead of the original event but the below query with makeresults does not give the same result:       | makeresults | eval tmp="{\"key\":\"value\"}" | rename tmp as _raw         only Statistics tab shows results.   To summarize, I want to get the event in the format that can be seen in the first screenshot above, but without running a search, because I already have the entire event, including its _raw. Any help is appreciated! ... View more