Getting Data In
Highlighted

Why does the search query does not show host, source, and sourcetype below each event?

Path Finder

Hi, I am taking Splunk Fundamentals course and during one of the lab exercises related to performing a search operation i noticed that my output of search query does not show the common fields like "host, source and source type" below each event , which are normally supposed to be extracted by default. My question is not about lab manual. Basically, i am curious as in What is making splunk to not show these 3 fields? I am using the exact query that is listed in the manual. Please refer to below screenshots.

My output ( which doesn't show those 3 fields)
alt text

Expected output as shown in the lab manual :

alt text

0 Karma
Highlighted

Re: Why does the search query does not show host, source, and sourcetype below each event?

Esteemed Legend

The in-line callout of fields and values happens for selected fields. To select a field, click on the All Fields link to get a field selector. Click on the checkbox to the left of whichever fields you would like Selected. Then click the Done button. You will see a new Selected Fields section above your existing Interesting Fields section and your in-line callouts should be there, too. These settings are somewhat sticky and I believe related to the neglected/no-longer-really-supported viewstates feature of Splunk.

Highlighted

Re: Why does the search query does not show host, source, and sourcetype below each event?

Path Finder

Thank you woodcock & Renjith.

Highlighted

Re: Why does the search query does not show host, source, and sourcetype below each event?

Esteemed Legend

Up-Votes appreciated.

0 Karma
Highlighted

Re: Why does the search query does not show host, source, and sourcetype below each event?

Path Finder

Granted. Sorry getting used to splunk forums.

Highlighted

Re: Why does the search query does not show host, source, and sourcetype below each event?

SplunkTrust
SplunkTrust

Hi @neerajshah81,

The default fields displayed with the event is decided by the user "Selected Fields" which is normally shown on the left panel under "Selected fields" and on basis of the user selection - expanding the event and select the fields manually(selecting checkbox). Configuration setting is stored in ui-prefs.conf of the user ie. splunk\etc\users\"user_name"\search\local\ui-prefs.conf

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.