Investigate: Manage Column Groups in the Events View

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Apr 25, 2019
Version 17Show Document
  • View in full screen mode

When viewing a list of events in Events view, you can customize the way data is displayed by defining the meta key or meta entity to display in a column, the position of the column in the list, and the default width of the column.

Note: Investigate profiles can include custom column groups. If a custom column group is used in a profile and you are viewing events in the Events view using a custom column group, you cannot change the view type (Detail, List, or Log). 

Create Custom Column Group

  1. Go to NAVIGATE > Events.
  2. Select Manage Column Groups in the View drop-down menu. The View option is named for the current value, for example, Detail View, List View, Log View, or the currently selected column group.
    The Manage Column Groups dialog is displayed.
    the Manage Column Groups dialog
  3. To add a new column group in the column group panel, click Add icon and type the name of the new group in the resulting field.
    The column definition panel opens on the right with the group name filled in. You can edit the group name.
  4. To add a column to the group, click Add icon, and click in the empty Meta Key field to display the Meta Key drop-down list. Select a meta key field from the list, and repeat this step until the column set is complete.
    the Manage Column Groups dialog showing a new column and the meta key drop-down list
  5. (Optional) To delete a meta key from the column group, click Delete icon.
  6. (Optional) To rearrange the sequence in which the columns appear in the Events list, drag meta keys to the desired position.
  7. (Optional) To set the default width for a column, click in the corresponding value in the Width column, and type a new column width.
    Manage Column Groups dialog with a meta key defined
  8. (Optional) To revert to the previous settings for the column group, and undo all of your changes, click Reset.
  9. When ready to save, do one of the following:
    1. To save the edited column group and refresh the Events view with the column group settings, click Save and Apply.
    2. To save the edited column group without refreshing the Events view, click Save.

Select a Column Group

To select a column group:

  1. With the Events view open, select Custom Column Groups in the View drop-down menu. The option name is the default value (Detail View or the current value).
    the Custom Column Groups menu
  2. Select one of the column groups from the submenu.
    The Events view is refreshed to reflect the custom column group. In Version 11.2 and later, any preQuery in the column group is displayed in the breadcrumb.


You are here
Table of Contents > Examining Raw Events in the Events View > Manage Column Groups in the Events View