Getting Data In
Highlighted

Why sometimes sourcetype doesn't appear under Selected Fields?

Ultra Champion

For most data sources in our set-up, sourcetype appears under Selected Fields, but there are cases in which it appears under the Interesting Fields section. Why is that?

0 Karma
Highlighted

Re: Why sometimes sourcetype doesn't appear under Selected Fields?

SplunkTrust
SplunkTrust

According to this one - https://answers.splunk.com/answers/185864/selected-fields-in-fields-side-bar.html, selected fields have app-level defaults but if you change the selection at any time, you user preferences are stored locally for you. That probably means at one time you accidentally removed it from your preferences for that type of event.

An interesting field is any field that appears in 20% or more of the data, but is not a selected field. (You can change the 20% number if you want.)

View solution in original post

0 Karma
Highlighted

Re: Why sometimes sourcetype doesn't appear under Selected Fields?

Ultra Champion

Perfect @DalJeanis - thank you.