Splunk Search

set default selected fields

gfriedmann
Communicator

I have added an automatic lookup based on host value. This lookup creates the field "bettername". I want all users to notice this new field to leverage.

You may have noticed that host, source, and sourcetype are listed as "selected fields" by default on the left blue column.

How can i add my new "bettername" as a default selected field? Is there a way of doing this from the .conf files?

I think the advanced XML method involved the FieldPicker module.

puneethgowda
Communicator

Thank you very helpfull

0 Karma

ziegfried
Influencer

You can do this by creating a default viewstates.conf. Just create a file named viewstates.conf with the following content:

[flashtimeline:_current]
FieldPicker_0_6_1.fields = host,sourcetype,source,bettername

in the default or local subdirectory of your app.

Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...