Alerting

Why email drilldown results don't display fields?

elusive
Splunk Employee
Splunk Employee

When I drilldown on an email alert it shows results but the fields are empty. When I rerun the result by clicking on > (next to timerange picker), fields are now displayed. Why is this and is there a way to enable fields at drilldown?

BobM
Builder

Another option that may be easier than editing the config file is to finish your search with "| fields + *" which will add in all fields.

elusive
Splunk Employee
Splunk Employee

By default, fields do not show up when drilldown on email alert links or RSS feeds. We do not generate by default for performance reasons. You can enable Splunk to show fields when drilldown on email alerts or RSS Feeds by setting:

[search stanza]
search = <your search>
dispatch.buckets = 1 

dispatch.buckets = 1 will extract the fields and display the fields upon drilldown.

Note: performance can be affected.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...