Splunk Search

Alt-Click not working selected fields

antlefebvre
Communicator

When I have an event where there is selected fields that I want to eliminate, if I ALT-click on the value in the selected field it adds it to the search rather than removing it.

Ex I ALT-click machine1 in the selected field host = machine1

Which should add NOT host="machine1" to the search. Instead it just adds host="machine1" to the search. I believe that this has happened since I upgraded to Splunk 6.

Any ideas as to why this happens. If I alt click in the actual event on a field it works fine.

1 Solution

sideview
SplunkTrust
SplunkTrust

Unfortunately this is a bug in Splunk 6. It was reported as a bug during the Splunk 6 beta program (at least by me), but it wasn't fixed in time for the GA release.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Unfortunately this is a bug in Splunk 6. It was reported as a bug during the Splunk 6 beta program (at least by me), but it wasn't fixed in time for the GA release.

yuvalba
Path Finder

Can anyone confirm whether it's fixed / still broken on 6.2?

0 Karma

dfronck
Communicator

I opened a ticket for this and here is the response.

"It is a bug BETA-641."

"The feature of the altclick was in version 5.* and is indeed missing in version 6.0.* and has been scoped to be reintroduced for the next major version that has no ETA or version # yet."

0 Karma

dfronck
Communicator

I just upgraded to 6.0.2 and it's still broken. I have sideview utils loaded and created a dashboard with that and it works there but they are using the old style interface.

elof
Path Finder

How does one find your bug report and bump it? This is still an issue!

yuvalba
Path Finder

It seems that it's still not fixed also in 6.0.1 😞
At least according to the release notes

0 Karma

antlefebvre
Communicator

Thanks. Glad to know it isn't just me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...