https://community.splunk.com/t5/Splunk-Search/Show-source-not-available-for-this-event/m-p/90265#M23184 <P>I have an issue where some users always get the message 'Show source not available for this event' when using the 'Show Source' option.</P> <P>I believe that this is due to the fact that the role that they are using has restricted search terms set. The search terms that are used are populated using an automatic lookup which all works when a normal search is executed but not when the 'Show Source' search is run.</P> <P>The following is in audit.log with the search term cluster=foo and enable_lookups=0:</P> <PRE><CODE>10-12-2011 11:15:54.802 +0100 INFO AuditLogger - Audit:[timestamp=10-12-2011 11:15:54.802, user=foo, action=search, info=granted , search_id='1318414554.157878.host1-foo', search='surrounding id=295:147390236 index=foo searchkeys="" timeBefore=86400 timeAfter=86400 maxresults=50 timestamp=1318414454.981 filter=" ( ( cluster=foo ) ) "', autojoin='0', buckets=0, ttl=30, max_count=50, maxtime=0, enable_lookups='0', extra_fields='', apiStartTime='ZERO_TIME', apiEndTime='ZERO_TIME', savedsearch_name=""][n/a] </CODE></PRE> <P>How do I change enable_lookups to 1 for this search?</P> <P>Is there something else I can do?</P> <P>Thanks</P> Wed, 12 Oct 2011 10:31:18 GMT craigmunro 2011-10-12T10:31:18Z https://community.splunk.com/t5/Splunk-Search/Show-source-not-available-for-this-event/m-p/90265#M23184 <P>I have an issue where some users always get the message 'Show source not available for this event' when using the 'Show Source' option.</P> <P>I believe that this is due to the fact that the role that they are using has restricted search terms set. The search terms that are used are populated using an automatic lookup which all works when a normal search is executed but not when the 'Show Source' search is run.</P> <P>The following is in audit.log with the search term cluster=foo and enable_lookups=0:</P> <PRE><CODE>10-12-2011 11:15:54.802 +0100 INFO AuditLogger - Audit:[timestamp=10-12-2011 11:15:54.802, user=foo, action=search, info=granted , search_id='1318414554.157878.host1-foo', search='surrounding id=295:147390236 index=foo searchkeys="" timeBefore=86400 timeAfter=86400 maxresults=50 timestamp=1318414454.981 filter=" ( ( cluster=foo ) ) "', autojoin='0', buckets=0, ttl=30, max_count=50, maxtime=0, enable_lookups='0', extra_fields='', apiStartTime='ZERO_TIME', apiEndTime='ZERO_TIME', savedsearch_name=""][n/a] </CODE></PRE> <P>How do I change enable_lookups to 1 for this search?</P> <P>Is there something else I can do?</P> <P>Thanks</P> Wed, 12 Oct 2011 10:31:18 GMT https://community.splunk.com/t5/Splunk-Search/Show-source-not-available-for-this-event/m-p/90265#M23184 craigmunro 2011-10-12T10:31:18Z https://community.splunk.com/t5/Splunk-Search/Show-source-not-available-for-this-event/m-p/90266#M23185 <P>We finally reported this to Splunk who have accepted this as a bug. The bug reference is SPL-56774. It's scheduled to be fixed in 4.3.6 or 5.0.3. </P> Fri, 11 Jan 2013 16:22:02 GMT https://community.splunk.com/t5/Splunk-Search/Show-source-not-available-for-this-event/m-p/90266#M23185 craigmunro 2013-01-11T16:22:02Z