Splunk Enterprise

How to view all sources

super_saiyan
Communicator

hello everyone,

i ran a search query and in "source" section i can see 100+ results.

but when i clicked on it i was only able to see 10 sources.

how can i see / view all sources ?

 

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

The list of fields on the left shows only fields which are present in a certain percentage of returned events (at least 20% if I'm not mistaken). And if you click o them you indeed get top 10 values for each field.

This is useful for a quick overview and initial exploration of your data but to get some more specific results, you have to search for them explicitly.

In your case you might wan to do

<your_search> | stats values(source)

or

<your_search> | stats count by source

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you cannot see those on that box. But you could write SPL to see those. One simple way is e.g. 

...
| dedup source
| table source 

There are lot of different queries which you could do for this. 
r. Ismo

PickleRick
SplunkTrust
SplunkTrust

The list of fields on the left shows only fields which are present in a certain percentage of returned events (at least 20% if I'm not mistaken). And if you click o them you indeed get top 10 values for each field.

This is useful for a quick overview and initial exploration of your data but to get some more specific results, you have to search for them explicitly.

In your case you might wan to do

<your_search> | stats values(source)

or

<your_search> | stats count by source
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...