I have recently upgraded from 4.3 to the latest 5.x version. I found that now when I use the table command the fieldset on the left hand side disappears and I cant click on the selector to go from tableView to the raw log events. I frequently use a macro that puts the fields into a table by the headers I have chosen, and I get value out of this because I can use the fieldset to narrow the search. Is this a bug or is there a way around this for 5.X
Thank you.
You will want to change the "Smart Mode" to "Verbose Mode".
http://docs.splunk.com/Documentation/Splunk/5.0.5/Search/Changethesearchmode
You will want to change the "Smart Mode" to "Verbose Mode".
http://docs.splunk.com/Documentation/Splunk/5.0.5/Search/Changethesearchmode
Thank you!