Dashboards & Visualizations

How to setup "show source" at the drop-down box at the left of any search result?

Path Finder

I've got a user that is missing the "show source" entry at the drop-down box at the left of any search result. How does she set it up?

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

View solution in original post

Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

View solution in original post

Splunk Employee
Splunk Employee

Note on the Note: This still applies to 4.0 since workflow actions did not exist until 4.1

0 Karma

SplunkTrust
SplunkTrust

Note: This problem only applies to 3.X builds. In 4.1 'Show Source' is a workflow action and they will appear in the event pulldown regardless of whether the field or fields happen to be selected in the FieldPicker. Also, the fields that this particular workflow action uses in 4.1 are no longer source and host. In brief it now sends the search id and offset instead.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!