My question is a duplicate of this one, but since I couldn't comment there, I figured I'd ask again:
When I click view source on an event that has a large number of lines (for example, a Java error with 200+ lines), the view source screen only shows first 100 lines of the original log.
This is actually listed as a feature with 4.x Splunk. Is there a way to increase this so when I click on view source I see the whole original log?
According to the only answer, this is a bug that should be fixed in v4.1.3. However, I'm running v4.1.4 (82143) and still cannot see more than 100 lines in Show Source.
Please see if this Q&A helps. I tried and it seems to be working. You need to have admin right. Please note that I found the show_source.xml in the default directory rather than local directory indicated in the answer.