Show source not available for this event

[craigmunro]

I have an issue where some users always get the message 'Show source not available for this event' when using the 'Show Source' option.

I believe that this is due to the fact that the role that they are using has restricted search terms set. The search terms that are used are populated using an automatic lookup which all works when a normal search is executed but not when the 'Show Source' search is run.

The following is in audit.log with the search term cluster=foo and enable_lookups=0:

10-12-2011 11:15:54.802 +0100 INFO  AuditLogger - Audit:[timestamp=10-12-2011 11:15:54.802, user=foo, action=search, info=granted , search_id='1318414554.157878.host1-foo', search='surrounding id=295:147390236 index=foo searchkeys="" timeBefore=86400 timeAfter=86400 maxresults=50 timestamp=1318414454.981 filter=" ( ( cluster=foo )  ) "', autojoin='0', buckets=0, ttl=30, max_count=50, maxtime=0, enable_lookups='0', extra_fields='', apiStartTime='ZERO_TIME', apiEndTime='ZERO_TIME', savedsearch_name=""][n/a]

How do I change enable_lookups to 1 for this search?

Is there something else I can do?

Thanks

[craigmunro · Accepted solution]

We finally reported this to Splunk who have accepted this as a bug. The bug reference is SPL-56774. It's scheduled to be fixed in 4.3.6 or 5.0.3.