View selector
- Juan Tomás Alonso Nieto (Deactivated)
- Borja Moro Moreno
- Former user (Deleted)
Overview
The view selector allows you to customize how you view your data for visualization and analysis. You can choose between two different views using the selector indicated in the picture below:
Table view - The default view, where event fields are split into different fields. Learn more
List view - In this view, each event is displayed in a single row as a list of keys and values. Learn more
There are several operations common to both views:
All shortcuts available in the table view apply in the list view. To see details, go to section 10 below about the Data table.
Right-clicking any field provides further options to optimize data analysis.
To learn more about each option, go to the related content:
Table view
This is the default view when accessing the data search window. This standard view shows each event as an individual row in the table, with its fields split into fields.
List view
In this view, the event fields are no longer shown as fields. Rather, event information is displayed in a single row as a list of keys and values. This way, you can view the entire event and all its fields on screen in one click.
This view consists of two fields: the first one is the eventdate or creation date, and the second lists all key-value pairs.
Extra fields, such as raw, will show in orange.
If the data table has a creationdate field, you can choose to sort the events by creation date or event date in list view using the Time Control Settings detailed above.
Customizing the list view data
You can further configure how event fields are shown using the Event settings option in the top right.
There are various options available:
Show field names  | Toggling off removes the field names, leaving just the data type and field value. This option is activated by default. |
|---|---|
Show data types | Toggling off removes the data type, leaving the field name and value. This option is activated by default. |
Show null values | Toggle off to remove null values. |
Copying values
The list view allows you to copy individual values within an event using the key-value pairs. Using the standard ctrl + c and ctrl + v will copy the field name and value.
Alternatively, you can choose which fields to copy by right-clicking > Copy and choosing between the available options:
Copy: includes the entire key-value pair
Copy only:
Name: includes only the name field.
Value: includes only the value field.
When only part of the text is selected, copying using right-click or keystrokes applies to the selected part only, whereas filtering, drill downs and pretty print apply to the entire value.