2 Select the Open Raw Data Tap option to display the Raw Data window.
You can view the detailed information in the Raw Data Details section. If you do not see the
information, check to see if you need to reconfigure the system to send the syslog data to
include the missing information
If the Collector parsing logic could not parse the existing raw data, the fields might not be displayed
or might be labeled Unknown. To fix this, the Collector parsing logic needs to be enhanced.
Occasionally, the search engine might index events faster than they are inserted into the data
directory. If you run a search that returns events that were not inserted into the data directory, you
get a message indicating that some events match the search query, but they are not found in the
directory. If you run the search again later, the events are in the
shown as successful.
5.3.2 Event View with Details
1 To view the details about all the events, click the all details link at the top of the search results
page.
You can expand or collapse the details for all events on a page by using the all details+ or all
details- link.
2 To view details about any individual event, click the details link at the right side of the page.
You can expand or collapse the details for all events on a page by using the details+ or details-
link.
directory and the search is
data
data
Searching
83