Splunk Enterprise

How to view all sources

super_saiyan
Communicator

hello everyone,

i ran a search query and in "source" section i can see 100+ results.

but when i clicked on it i was only able to see 10 sources.

how can i see / view all sources ?

 

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

The list of fields on the left shows only fields which are present in a certain percentage of returned events (at least 20% if I'm not mistaken). And if you click o them you indeed get top 10 values for each field.

This is useful for a quick overview and initial exploration of your data but to get some more specific results, you have to search for them explicitly.

In your case you might wan to do

<your_search> | stats values(source)

or

<your_search> | stats count by source

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you cannot see those on that box. But you could write SPL to see those. One simple way is e.g. 

...
| dedup source
| table source 

There are lot of different queries which you could do for this. 
r. Ismo

PickleRick
SplunkTrust
SplunkTrust

The list of fields on the left shows only fields which are present in a certain percentage of returned events (at least 20% if I'm not mistaken). And if you click o them you indeed get top 10 values for each field.

This is useful for a quick overview and initial exploration of your data but to get some more specific results, you have to search for them explicitly.

In your case you might wan to do

<your_search> | stats values(source)

or

<your_search> | stats count by source
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...