Display a field separately in the log details flyout 🔗
Note
Customers with a Splunk Log Observer entitlement in Splunk Observability Cloud must transition from Log Observer to Log Observer Connect by December 2023. With Log Observer Connect, you can ingest more logs from a wider variety of data sources, enjoy a more advanced logs pipeline, and expand into security logging. See Splunk Log Observer transition to learn how.
The log details flyout in Log Observer always displays the message
field in a standalone section called MESSAGE at the top of the log details flyout.
Your team can choose to display any field of your choice in the MESSAGE section. To display a field of your choice separately, alias the desired field to the message
field. See Create field aliases to learn how.
For example, say your team most frequently uses the summary
field. Add an alias for the summary
field called message
. The summary
field still exists but is also known as message
and appears in the MESSAGE section of the log details flyout.