How to setup "show source" at the drop-down box at the left of any search result?

[Alan_Bradley]

I've got a user that is missing the "show source" entry at the drop-down box at the left of any search result. How does she set it up?

[matt · Accepted solution]

The fields source and host are linked to "show source", without those field checked, show source in the event drop down does not show up because Splunk wont know which source to show.

[matt]

Note on the Note: This still applies to 4.0 since workflow actions did not exist until 4.1

[sideview]

Note: This problem only applies to 3.X builds. In 4.1 'Show Source' is a workflow action and they will appear in the event pulldown regardless of whether the field or fields happen to be selected in the FieldPicker. Also, the fields that this particular workflow action uses in 4.1 are no longer source and host. In brief it now sends the search id and offset instead.