When I drilldown on an email alert it shows results but the fields are empty. When I rerun the result by clicking on > (next to timerange picker), fields are now displayed. Why is this and is there a way to enable fields at drilldown?
By default, fields do not show up when drilldown on email alert links or RSS feeds. We do not generate by default for performance reasons. You can enable Splunk to show fields when drilldown on email alerts or RSS Feeds by setting: