When using search queries in OMS, a list view is used to display all the results one after the other. The advantage of this view is, that you can easily access all the available properties of the collected events.

However, there are situations where a list view is not really useful and presenting the search results in a table works out better. You can either click on the “Table” tab to switch the view, or you can pipe the search results directly to a table view by using  “| Display Table”.

There are more view types you can use to pipe data to. OMS supports different visuals,  today that’s the “Stacked Bar Chart” and the “Line Chart”. You can again use “| Display StackedBarChart” and “| Display LineChart” to output the results in the preferred format.

There are more options available to visualize result data, e.g. “Metrics”, but they cannot (yet) be used directly in the search queries.

Cheers
Marcel