Absolutely. The most unobtrusive way to do this might be with a select box, and setting intentions. (Perhaps someone else can jump in to verify that?) Alternatively, you could add it to the context by overriding something in application.js (which is more complex). A third way would be to use Sideview Utils, which contains the ValueSetter module that makes this process exceedingly easy. Switching to sideview is a relatively large project if you already have a lot of advanced XML out there, but relatively minor if you're just starting into the world of Advanced XML. (And it will significantly increase the functionality offered by Splunk overall, to boot). ... View more

Thanks for the info, I will look at Sideview for use in the future. ... View more

I guess it doesn't. Never mind. ... View more