How to view all sources

[super_saiyan]

hello everyone,

i ran a search query and in "source" section i can see 100+ results.

but when i clicked on it i was only able to see 10 sources.

how can i see / view all sources ?

[isoutamo]

Hi

you cannot see those on that box. But you could write SPL to see those. One simple way is e.g. 

...
| dedup source
| table source 

There are lot of different queries which you could do for this. 
r. Ismo

[PickleRick · Accepted solution]

The list of fields on the left shows only fields which are present in a certain percentage of returned events (at least 20% if I'm not mistaken). And if you click o them you indeed get top 10 values for each field.

This is useful for a quick overview and initial exploration of your data but to get some more specific results, you have to search for them explicitly.

In your case you might wan to do

<your_search> | stats values(source)

or

<your_search> | stats count by source