For Windows event-log events, Splunk displays the first 5 lines followed by "Show all [n] lines". Most of the time, the good stuff is in the [n] lines, which leads to lots of clicking and expansion. For example, a single event looks like:
06/12/2015 11:54:10 AM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Show all 12 lines
Is the "show all" threshold configurable, or is there a way to alter the events themselves to be single-line, something like...
06/12/2015 11:54:10 AM
LogName=System, SourceName=Microsoft-Windows-Service Control Manager, EventCode=7036, EventType=4
etc.
... View more