Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Alt-Click not working selected fields
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I have an event where there is selected fields that I want to eliminate, if I ALT-click on the value in the selected field it adds it to the search rather than removing it.
Ex I ALT-click machine1 in the selected field host = machine1
Which should add NOT host="machine1" to the search. Instead it just adds host="machine1" to the search. I believe that this has happened since I upgraded to Splunk 6.
Any ideas as to why this happens. If I alt click in the actual event on a field it works fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately this is a bug in Splunk 6. It was reported as a bug during the Splunk 6 beta program (at least by me), but it wasn't fixed in time for the GA release.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately this is a bug in Splunk 6. It was reported as a bug during the Splunk 6 beta program (at least by me), but it wasn't fixed in time for the GA release.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone confirm whether it's fixed / still broken on 6.2?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I opened a ticket for this and here is the response.
"It is a bug BETA-641."
"The feature of the altclick was in version 5.* and is indeed missing in version 6.0.* and has been scoped to be reintroduced for the next major version that has no ETA or version # yet."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just upgraded to 6.0.2 and it's still broken. I have sideview utils loaded and created a dashboard with that and it works there but they are using the old style interface.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How does one find your bug report and bump it? This is still an issue!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It seems that it's still not fixed also in 6.0.1 😞
At least according to the release notes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. Glad to know it isn't just me.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
