This topic provides instructions for an analyst to create and manage custom column groups for displaying data in the Events view.
When viewing a list of events in Events view, you can customize the way data is displayed by defining the meta to display in a column, the position of the column in the grid, and the default width of the column.
Create Custom Column Group
- In the Investigate view, select the Events view.
- Select Manage Column Groups in the View drop-down menu. The View option is named for the current value, for example, Detail View, List View, Log View, or the currently selected column group.
The Manage Column Groups dialog is displayed.
- To add a new column group in the column group panel, click and type the name of the new group in the resulting field.
- The column definition panel opens on the right with the group name filled in. You can edit the group name.
- To add a column to the group, click , and click in the empty Meta Key field to display the Meta Key drop-down list.
- Select a meta key field from the list, and repeat this step until the column set is complete.
- (Optional) To delete a meta key from the column group, click .
- (Optional) To rearrange the sequence in which the columns appear in the Events list, drag meta keys to the desired position.
- (Optional) To set the default width for a column, click in the corresponding value in the Width column, and type a new column width.
- (Optional) To revert to the previous settings for the column group, and undo all of your changes, click Reset.
- When ready to save, do one of the following:
- To save the edited column group and refresh the Events view with the column group settings, click Save and Apply.
- To save the edited column group without refreshing the Events view, click Save.