Dashboards & Visualizations

How to setup "show source" at the drop-down box at the left of any search result?

Alan_Bradley
Path Finder

I've got a user that is missing the "show source" entry at the drop-down box at the left of any search result. How does she set it up?

Tags (2)
0 Karma
1 Solution

matt
Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

View solution in original post

matt
Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

matt
Splunk Employee
Splunk Employee

Note on the Note: This still applies to 4.0 since workflow actions did not exist until 4.1

0 Karma

sideview
SplunkTrust
SplunkTrust

Note: This problem only applies to 3.X builds. In 4.1 'Show Source' is a workflow action and they will appear in the event pulldown regardless of whether the field or fields happen to be selected in the FieldPicker. Also, the fields that this particular workflow action uses in 4.1 are no longer source and host. In brief it now sends the search id and offset instead.

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...