Is there a way to see the source file in Splunk for data indexed from HDFS using a virtual index?

[sdaruna]

Hi,

As part of our work, we need to index configuration files and prepare reports on them for our client. We need to recreate existing reporting framework with Splunk and as part of this, we need to allow users to view specific configuration files as they might compare two different files or perform diff etc.

I would like to see if there is a way to view the whole file in a pop-up window in Splunk search? If there is no way defined, could you please provide me the way to achieve it.?

[MuS]

Hi sdaruna,

I'm not sure if I understand your request completely....there is a way to show the source of search result:

After you ran your search, open the dropdown event menu (find the down arrow next to the event timestamp) and click Show Source from the Event Actions drop down.

Hope this helps ...

cheers, MuS

[sdaruna]

Hi,

I could not see show source on my events. I am getting data indexed from HDFS using virtual index and i am running on my local trail version. Which on would ve been reason for not finding it.?

[MuS]

just search on index=_internal or any other index to try it. I don't have access to a virtual index to test it 😞

[sdaruna]

Hi,

If i used local files, it works. But for the files in hdfs, it does not show the option "Show Source file"