Dashboards & Visualizations

How to setup "show source" at the drop-down box at the left of any search result?

Alan_Bradley
Path Finder

I've got a user that is missing the "show source" entry at the drop-down box at the left of any search result. How does she set it up?

Tags (2)
0 Karma
1 Solution

matt
Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

View solution in original post

matt
Splunk Employee
Splunk Employee

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

matt
Splunk Employee
Splunk Employee

Note on the Note: This still applies to 4.0 since workflow actions did not exist until 4.1

0 Karma

sideview
SplunkTrust
SplunkTrust

Note: This problem only applies to 3.X builds. In 4.1 'Show Source' is a workflow action and they will appear in the event pulldown regardless of whether the field or fields happen to be selected in the FieldPicker. Also, the fields that this particular workflow action uses in 4.1 are no longer source and host. In brief it now sends the search id and offset instead.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...