When a search returns __________, you can view the results as a list.

In Splunk, the “List” display option is only available for searches that return statistical results produced by a transforming command (for example stats, chart, timechart). In the Statistics tab of the Search & Reporting app you can use the Format menu to switch between Table and List views of those statistical values. Event-based results—whether individual events or transactions—are shown on the Events tab, which offers different formatting choices (Verbose, Smart, Fast) but no “List” view. Therefore, only statistical values can be displayed as a list.

A. a list of events – Events are displayed on the Events tab; formatting options do not include a List view, only event-centric modes (Verbose, Smart, Fast).
B. transactions – Transactions are treated as events and appear on the Events tab; they cannot be switched to List view, only event-oriented formats apply.

1. Splunk Enterprise Search Manual 9.1

“Format statistical results” – paragraph “You can display statistical search results as either a table or a list.” (docs.splunk.com/Documentation/Splunk/9.1.0/Search/Displaystatisticalresults)

2. Splunk Fundamentals 1 (eLearning)

Module “Search Results”

slide “Statistics tab: Table vs. List view” (course code SPLK-FUND-1

2023)

3. Splunk Enterprise Search Manual 9.1

“Events tab overview” – notes no List option for event display (docs.splunk.com/Documentation/Splunk/9.1.0/Search/Viewsearchresults)