Adding a Detail Panel

The detail panel contains the raw data from a search. This is the only panel that contains raw data.

To add a detail panel, complete the following steps:

Click the Discover tab.
Select the $DATASOURCE* index.
Search for docs in this index with type of $DATASOURCE_doc.
1. Type the following in the search field: _type: $DATASOURCE_doc.
2. Click the Search icon.
Select the subset of the fields that you want to display in the detail panel.
In the left panel under Available Fields, click each of the following fields, then click Add.
- full_hostname
- ip_src_addr
- ip_dst_addr
- original_string
- method
- type
Click the Save Search () button in the Discover toolbar to save the search.
Enter a name for the search ($DataSource Event Details) and click Save.
Select the Dashboard tab then click the Plus (+) button.
Click the Searches tab and select $DataSource Event Details.
The visualization will be added to the bottom of the dashboard.
Click the Save Dashboard () button in the Discover toolbar to save the dashboard.