If you say "*" as search, you see "show source" in the Event Options Menu by every
event. If you say "* | fields site" the "show source" option disappears from this menu.
This appears to be a regression from 4.2 (at least) to 5.0.
Thanks lguinn, I submitted a bug.
In general, |fields command seems perhaps buggy in 5.0.
Sorry to be so fuzzy, we just upgraded, so I'm just now looking at it.
lguinn or anybody else agree?
This is true - did you submit it as a bug here?
https://www.splunk.com/page/submit_issue
You don't need a support agreement to submit a bug, just a login here!