Hi,
When I click view source on an event that has a large number of lines (for example, a Java error with 200+ lines), the view source screen only shows first 100 lines of the original log.
This is actually listed as a feature with 4.x Splunk. Is there a way to increase this so when I click on view source I see the whole original log?
Thanks.
In 4.1.3, we made it so the events viewer had a configurable max eventsize ceiling (so we dont crash the browser). This is mentioned here: http://answers.splunk.com/questions/559/how-do-you-tweak-splunk-to-display-an-event-that-is-more-tha...
I think show source is still limited, as of 4.2, to 100 lines per event.
This is a bug that should be fixed in v4.1.3.