I am searching for logs, and when I click on 'Show source' they are more logs associated with it
Is there a way to have these other logs to show in the events? I cannot format Show Source as easily as the search events
Hi @TestQA52
try metadata command, it's really easier to check sources, sourcetypes and hosts
example for the sources:
| metadata type=sources
@aasabatini Hey, thank you. Im very new to Splunk
Sometext| metadata type=sources
I'm getting: or in 'metadata' command: This command must be the first command of a search
metadata type=sources | Sometext
It says Sometext is not a command
Hi @TestQA52
please read the documentation
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
anyway run the search like this
| metadata type=sources index=<your index> splunk_server=<your server>