Display a field separately in the log details flyout 🔗
Note
Customers with a Splunk Log Observer entitlement in Splunk Observability Cloud must transition from Log Observer to Log Observer Connect by December 2023. With Log Observer Connect, you can ingest more logs from a wider variety of data sources, enjoy a more advanced logs pipeline, and expand into security logging. See Splunk Log Observer transition to learn how.
The log details flyout in Log Observer always displays the message field in a standalone section called MESSAGE at the top of the log details flyout.
Your team can choose to display any field of your choice in the MESSAGE section. To display a field of your choice separately, alias the desired field to the message field. See Create field aliases to learn how.
For example, say your team most frequently uses the summary field. Add an alias for the summary field called message. The summary field still exists but is also known as message and appears in the MESSAGE section of the log details flyout.