How can I see what the source and sourcetype are for an Event

[igotimac]

In Previous versions of splunk on the search interface a "source" and "sourcetype" were reported underneath each in event.

In the latest version I see no way of determining what source log file a particular event came from. I can click on "show source" but this does not tell me the file name.

The dashboard still shows "source" and "sourcetype" and I can see that I can search based on these things, but if I search all sources I need a way to figure out which source a particular event came from.

[sideview]

2 possibilities --

1) if you're talking about in the main search interface by default we have 'source', 'sourcetype' and 'host' selected in the field picker.

It's possible that maybe you or someone else using the same login, at some point opened the Field picker popup and unchecked source and sourcetype.

To fix, after running your search in the search UI, click the 'Pick fields' link over in the blue sidebar. If source and sourcetype are only on the left side, click them and they'll be added to the selected fields over on the right side.

2) In a dashboard.

If on the other hand you have no idea what Im talking about above, you're probably asking how to do this in a dashboard. It's easy to put events on a dashboard, but i think by default they appear there with no fields, and you have to edit the XML to get them to do so...

So, if that's the case, to fix it click 'edit dashboard', then the 'Edit name/XML' link in the lower left of that panel.
Then a form with some XML will pop up. You'll see a bit that looks like

<event>
  <searchString>your search here.</searchString>
  <title>your panel name</title>
</event>

add a node to it like so:

<event>
  <searchString>your search here.</searchString>
  <title>your panel name</title>
  <fields>host sourcetype source</fields>
</event>

[Simeon]

The source and sourcetype fields should be shown by default. You may need to select them from the field picker window pane on the left side of the search interface. If you wanted Splunk to return the values for those fields, you could use the fields command. Your search would look something like:

my search query | fields source sourcetype