topic Re: Why does the search query does not show host, source, and sourcetype below each event? in Getting Data In

Why does the search query does not show host, source, and sourcetype below each event?

neerajshah81 — Wed, 11 Jul 2018 15:49:34 GMT

Hi, I am taking Splunk Fundamentals course and during one of the lab exercises related to performing a search operation i noticed that my output of search query does not show the common fields like "host, source and source type" below each event , which are normally supposed to be extracted by default. My question is not about lab manual. Basically, i am curious as in What is making splunk to not show these 3 fields? I am using the exact query that is listed in the manual. Please refer to below screenshots.

My output ( which doesn't show those 3 fields)

Expected output as shown in the lab manual :

Re: Why does the search query does not show host, source, and sourcetype below each event?

woodcock — Wed, 11 Jul 2018 16:01:22 GMT

The in-line callout of fields and values happens for selected fields. To select a field, click on the All Fields link to get a field selector. Click on the checkbox to the left of whichever fields you would like Selected. Then click the Done button. You will see a new Selected Fields section above your existing Interesting Fields section and your in-line callouts should be there, too. These settings are somewhat sticky and I believe related to the neglected/no-longer-really-supported viewstates feature of Splunk.

Re: Why does the search query does not show host, source, and sourcetype below each event?

renjith_nair — Wed, 11 Jul 2018 16:18:40 GMT

Hi @neerajshah81,

The default fields displayed with the event is decided by the user "Selected Fields" which is normally shown on the left panel under "Selected fields" and on basis of the user selection - expanding the event and select the fields manually(selecting checkbox). Configuration setting is stored in ui-prefs.conf of the user ie. splunk\etc\users\"user_name"\search\local\ui-prefs.conf

Re: Why does the search query does not show host, source, and sourcetype below each event?

neerajshah81 — Wed, 11 Jul 2018 18:45:04 GMT

Thank you woodcock & Renjith.

Re: Why does the search query does not show host, source, and sourcetype below each event?

woodcock — Wed, 11 Jul 2018 21:58:03 GMT

Up-Votes appreciated.

Re: Why does the search query does not show host, source, and sourcetype below each event?

neerajshah81 — Thu, 12 Jul 2018 00:51:51 GMT

Granted. Sorry getting used to splunk forums.