Display a field separately in the log details flyout 🔗
Customers with a Splunk Log Observer entitlement in Splunk Observability Cloud must transition from Log Observer to Log Observer Connect by January 2024. With Log Observer Connect, you can ingest more logs from a wider variety of data sources, enjoy a more advanced logs pipeline, and expand into security logging. See Splunk Log Observer transition to learn how.
The log details flyout in Log Observer always displays the
message field in a standalone section called MESSAGE at the top of the log details flyout.
Your team can choose to display any field of your choice in the MESSAGE section. To display a field of your choice separately, alias the desired field to the
message field. See Create field aliases to learn how.
For example, say your team most frequently uses the
summary field. Add an alias for the
summary field called
summary field still exists but is also known as
message and appears in the MESSAGE section of the log details flyout.