Event Options Menu lacks "show source" item if search has "fields" command in it.

[droth333]

If you say "*" as search, you see "show source" in the Event Options Menu by every
event. If you say "* | fields site" the "show source" option disappears from this menu.
This appears to be a regression from 4.2 (at least) to 5.0.

[droth333]

Thanks lguinn, I submitted a bug.
In general, |fields command seems perhaps buggy in 5.0.
Sorry to be so fuzzy, we just upgraded, so I'm just now looking at it.
lguinn or anybody else agree?

[lguinn2]

This is true - did you submit it as a bug here?

https://www.splunk.com/page/submit_issue

You don't need a support agreement to submit a bug, just a login here!