By default, the Event column on the Investigation tab contains a factor for the event. The factor view presents selected name-value pairs extracted from the event that identify the purpose and meaning of the event, as described in Factors are derived from an event dictionary.
You can change how a event is displayed. You can select the Details view, which shows all of the name-value pairs that were parsed out of the raw message, or you can view the Raw view, the message itself.
The UI provides two ways to switch the event format, described below.
Change event format for a single event
When you mouse over an event in the Investigation tab a plus sign (+) appears on the left side of the page.
When you click the icon, the event display area expands to show the Details view.
You can click Raw to display the raw message.
Change event format for a one or more events
If you want to change the event format for multiple events, select them using the appropriate multiple-select keyboard shortcuts.
Then choose View Detail or View Raw from the Actions menu.