Hi, I am taking Splunk Fundamentals course and during one of the lab exercises related to performing a search operation i noticed that my output of search query does not show the common fields like "host, source and source type" below each event , which are normally supposed to be extracted by default. My question is not about lab manual. Basically, i am curious as in What is making splunk to not show these 3 fields? I am using the exact query that is listed in the manual. Please refer to below screenshots.
My output ( which doesn't show those 3 fields)
Expected output as shown in the lab manual :
The in-line callout of fields and values happens for
selected fields. To select a field, click on the
All Fields link to get a field selector. Click on the checkbox to the left of whichever fields you would like
Selected. Then click the
Done button. You will see a new
Selected Fields section above your existing
Interesting Fields section and your in-line callouts should be there, too. These settings are somewhat sticky and I believe related to the neglected/no-longer-really-supported
viewstates feature of Splunk.
The default fields displayed with the event is decided by the user "Selected Fields" which is normally shown on the left panel under "Selected fields" and on basis of the user selection - expanding the event and select the fields manually(selecting checkbox). Configuration setting is stored in
ui-prefs.conf of the user ie.