This drilldown capability has actually been available since 1.2.0 (but the UI is much prettier now than it used to be). All the drilldown options for the Notable Events Review are documented here: http://docs.splunk.com/Documentation/ITSI/3.1.0/User/CreateCorrelationSearch#Notable_Events ... View more

Ooo good to know, I'll have to change my implementation a little bit. Thanks for sharing! ... View more

I don't specify a timestamp, I just want it to use the current time of indexing as the timestamp. I guess Splunk is just assuming that's a timestamp and splitting my events there. I am also not using a delimiting character to specify when to break events, but I'll test that out and see if that fixes my problem (I think it will). Thank you! And extra info to those reading, here is my current props.conf: [events] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=AUTO disabled=false MAX_EVENTS=10000 [matrix] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=AUTO disabled=false MAX_EVENTS=10000 ... View more

Thank you. This resolved the issue I was having too. ... View more