Dashboards & Visualizations

How to setup "show source" at the drop-down box at the left of any search result?

Alan_Bradley
Path Finder

I've got a user that is missing the "show source" entry at the drop-down box at the left of any search result. How does she set it up?

Tags (2)
0 Karma
1 Solution

matt
Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

View solution in original post

matt
Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

matt
Splunk Employee
Splunk Employee

Note on the Note: This still applies to 4.0 since workflow actions did not exist until 4.1

0 Karma

sideview
SplunkTrust
SplunkTrust

Note: This problem only applies to 3.X builds. In 4.1 'Show Source' is a workflow action and they will appear in the event pulldown regardless of whether the field or fields happen to be selected in the FieldPicker. Also, the fields that this particular workflow action uses in 4.1 are no longer source and host. In brief it now sends the search id and offset instead.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...