https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495550#M8550 <P>you can enable search assistant mode that would allow you auto populate option:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.3/Search/Usingthesearchassistant" target="_blank">https://docs.splunk.com/Documentation/Splunk/7.3.3/Search/Usingthesearchassistant</A></P> <P>OR<BR /> You can go to /etc/apps/user-prefs/default/user-prefs.conf :<BR /> Check for search assistant, below i have compact mode</P> <P>[general]<BR /> search_syntax_highlighting = 1<BR /> search_assistant = compact</P> Wed, 30 Sep 2020 03:19:59 GMT rkyadav 2020-09-30T03:19:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495547#M8547 <P>All</P> <P>Newbie question. When I go to do a splunk search and do not know the exact sourcetype name, shouldn't it auto populate as I'm typing it in? </P> <P>For example, suppose the sourcetype I wish to query is named: WindowsEventLogs</P> <P>On my search I type in: index=* sourcetype="win</P> <P>but it never autocompletes. In my lab environment it completes but not in this production environment. Is this a setting somewhere within splunk? </P> Mon, 02 Dec 2019 05:24:17 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495547#M8547 trojan_81 2019-12-02T05:24:17Z https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495548#M8548 <P>you can enable search assistant mode that would allow you auto populate option:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.3/Search/Usingthesearchassistant" target="_blank">https://docs.splunk.com/Documentation/Splunk/7.3.3/Search/Usingthesearchassistant</A></P> <P>OR <BR /> You can go to /etc/apps/user-prefs/default/user-prefs.conf :<BR /> Check for search assistant, below i have compact mode</P> <P>[general]<BR /> search_syntax_highlighting = 1<BR /> search_assistant = compact</P> Wed, 30 Sep 2020 03:13:26 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495548#M8548 rkyadav 2020-09-30T03:13:26Z https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495549#M8549 <P>@trojan_81 <BR /> If you good with above , please accept the answers.<BR /> thanks</P> Tue, 03 Dec 2019 07:46:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495549#M8549 rkyadav 2019-12-03T07:46:47Z https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495550#M8550 <P>you can enable search assistant mode that would allow you auto populate option:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.3/Search/Usingthesearchassistant" target="_blank">https://docs.splunk.com/Documentation/Splunk/7.3.3/Search/Usingthesearchassistant</A></P> <P>OR<BR /> You can go to /etc/apps/user-prefs/default/user-prefs.conf :<BR /> Check for search assistant, below i have compact mode</P> <P>[general]<BR /> search_syntax_highlighting = 1<BR /> search_assistant = compact</P> Wed, 30 Sep 2020 03:19:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/sourcetype-autopopulate/m-p/495550#M8550 rkyadav 2020-09-30T03:19:59Z