Splunk Dev

Splunk 5 -> Unable to view event list

lpolo
Motivator

Unable to switch from table to event list in Splunk 5. Query example:

sourcetype=any |stats count by x    
OR    
sourcetype=any |table a b c

Is this intentional in Splunk 5?

Thanks,
Lp

Tags (1)
0 Karma

RicoSuave
Builder

Hello lpolo,
The flashtimeline now has a button on the upper right side where you can select three different modes for searching: fast, smart, and verbose. Anything other than verbose will not allow you to click the events viewer since the raw events will not be available. This is by design, and partially, why fast and smart are able to return results very quickly. So select verbose, and you should now be able to click on events list.

more info here

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Changethesearchmode

Directly from that page:

Under the Fast mode you'll only see event lists and see event timelines for searches that do not include reporting commands.

RicoSuave
Builder

Please accept the answer

0 Karma

lpolo
Motivator

Thanks. Worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...