Getting Data In

Is there a way to see the source file in Splunk for data indexed from HDFS using a virtual index?

Explorer

Hi,

As part of our work, we need to index configuration files and prepare reports on them for our client. We need to recreate existing reporting framework with Splunk and as part of this, we need to allow users to view specific configuration files as they might compare two different files or perform diff etc.

I would like to see if there is a way to view the whole file in a pop-up window in Splunk search? If there is no way defined, could you please provide me the way to achieve it.?

Tags (4)
0 Karma

SplunkTrust
SplunkTrust

Hi sdaruna,

I'm not sure if I understand your request completely....there is a way to show the source of search result:

After you ran your search, open the dropdown event menu (find the down arrow next to the event timestamp) and click Show Source from the Event Actions drop down.

alt text

Hope this helps ...

cheers, MuS

0 Karma

Explorer

Hi,

I could not see show source on my events. I am getting data indexed from HDFS using virtual index and i am running on my local trail version. Which on would ve been reason for not finding it.?

0 Karma

SplunkTrust
SplunkTrust

just search on index=_internal or any other index to try it. I don't have access to a virtual index to test it 😞

0 Karma

Explorer

Hi,

If i used local files, it works. But for the files in hdfs, it does not show the option "Show Source file"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!