Dashboards & Visualizations

Form/View to display "host" "source"

wang
Path Finder

I have defined a form/view and in its result page, there is no info for host or source, like in a regular search results page. How do I include those fields for display?

Tags (1)
0 Karma

wang
Path Finder

OK, I figured it out. I need to add: host source

<row>
  <event>
        <fields>host source</fields> 
        <option name="showPager">true</option>
        <option name="count">50</option>
        <option name="displayRowNumbers">false</option>
  </event>
</row>
0 Karma

wang
Path Finder

Oops, don't know what happened but here again are the form events:

<row>
  <event> 
        <option name="showPager">true</option>
        <option name="count">50</option>
        <option name="displayRowNumbers">false</option>
  </event>
</row>
0 Karma

wang
Path Finder

Thanks for the pointer on including the host and source fields. Now I get them when I run the search manually but still not from the form output. In other words, if I grep the "Saved Search" from the form and execute that manually, the host and source are displayed. But not in the form results page.

It seems like the configuration of the form is suppressing that. Do I need to specify some event options to enable display of extra fields like host and source?

Here is what I have in the form: true 50 false

0 Karma

Genti
Splunk Employee
Splunk Employee

Depending on what your form/view looks like you might want to add this to the search that populates it:

<original search> | fields host source <any additional ones>

Otherwise, provide some more info on how you are building this form/view

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...