Why does the search query does not show host, source, and sourcetype below each event?

[neerajshah81]

Hi, I am taking Splunk Fundamentals course and during one of the lab exercises related to performing a search operation i noticed that my output of search query does not show the common fields like "host, source and source type" below each event , which are normally supposed to be extracted by default. My question is not about lab manual. Basically, i am curious as in What is making splunk to not show these 3 fields? I am using the exact query that is listed in the manual. Please refer to below screenshots.

My output ( which doesn't show those 3 fields)

Expected output as shown in the lab manual :

[renjith_nair · Accepted solution]

Hi @neerajshah81,

The default fields displayed with the event is decided by the user "Selected Fields" which is normally shown on the left panel under "Selected fields" and on basis of the user selection - expanding the event and select the fields manually(selecting checkbox). Configuration setting is stored in ui-prefs.conf of the user ie. splunk\etc\users\"user_name"\search\local\ui-prefs.conf

[woodcock]

The in-line callout of fields and values happens for selected fields. To select a field, click on the All Fields link to get a field selector. Click on the checkbox to the left of whichever fields you would like Selected. Then click the Done button. You will see a new Selected Fields section above your existing Interesting Fields section and your in-line callouts should be there, too. These settings are somewhat sticky and I believe related to the neglected/no-longer-really-supported viewstates feature of Splunk.

[neerajshah81]

Thank you woodcock & Renjith.

[woodcock]

Up-Votes appreciated.

[neerajshah81]

Granted. Sorry getting used to splunk forums.