Skip to main content
Sumo Logic

Choose event display format: factors, details, or raw

By default, the Event column on the Investigation tab contains a factor for the event. The factor view presents selected name-value pairs extracted from the event that identify the purpose and meaning of the event, as described in Factors are derived from an event dictionary.

You can change how a event is displayed. You can select the Details view, which shows all of the name-value pairs that were parsed out of the raw message, or you can view the Raw view, the message itself.

The UI provides two ways to switch the event format, described below.

Change event format for a single event

When you mouse over an event in the Investigation tab a plus sign (+) appears on the left side of the page.

factor-format-plus-icon.png

When you click the icon, the event display area expands to show the Details view. 

event-format-options.png

You can click Raw to display the raw message.

event-format-options-raw.png

Change event format for a one or more events

If you want to change the event format for multiple events, select them using the appropriate multiple-select keyboard shortcuts.

Then choose View Detail or View Raw from the Actions menu.