Display Results and Events
LogScale presents the data returned from a search in a list format. By default, this list includes the @timestamp and @rawstring columns, plus any columns selected in the Fields panel.
Display tabs
Depending on the contents and functions used in the query, different tabs for displaying output data appear based on the query, for example if the query includes Aggregate Query Functions. Available tabs are:
Results tab. Sometimes also referred to as the Event list that displays the results of a query, presents the final results from the query once all of the elements of the source query including filters and aggregations (for example using
groupBy()) have been completed.
Events tab. Presents the raw event data after matches and filtering, but before aggregation.
Table tab. Appears for each table defined when the
defineTable()function is used in the source query. The display of matching entries for the table is limited to the first 500 rows. For more information, see How to Use Ad-hoc Tables in Queries.
Display options
You can change the way events are displayed from the toolbar above the Event list:
 |
Figure 62. Event Display Modes
Display options are (left to right in the toolbar):
Filter match highlighting allows highlighting results based on the filters applied in queries. See Highlight Filter Match for more information.
Scroll to selected event makes it possible to scroll fields starting from a selected event.
Text wrapping is used to wrap lines or truncate fields after the first line.
Sort events changes the order of fields in the event. You can choose whether newest events appear at the bottom or top of the list.
Toggle fullscreen displays events in full-screen mode.