Hi, I've currently got a google maps module but I'm unable to add a zoom level and center to it. How can I do this? Currently my module looks like this: <module autoRun="True" group="Venue" name="HiddenSearch"> <param name="search">search is here</param> <module name="SimpleResultsHeader"> <param name="entityName">events</param> <param name="headerFormat">Found %(count)s users $time$</param> <module name="GoogleMaps"> <param name="height">600px</param> <param name="scrollwheel">off</param> <param name="mapType">splunk</param> <param name="mapStyles">splunk,satellite</param> <param name="autoPostProcess">off</param> <param name="drilldown">true</param> <param name="overlay">clusters</param> <param name="overlay.style">m</param> <param name="overlay.rangeMap">0, 50, 200, 500, 5000</param> <param name="overlay.roundQuantity">true</param> </module> </module> </module> I've tried adding: <param name="center">22.318478,114.17284</param> <param name="zoom">3</param> But this doesn't work Any ideas? ... View more

Hi, I currently need to develop a report which plots all users within a custom circle on Splunk maps. The user will put in a custom lat, lon and radius to create the circle. How can I make this a limitation on the map? Is there a feature for this or do I need to make a mathematical calculation? The example query I want to alter is: index=main lat/lon_within_circle=($lat_term$ $lon_term$ $radius_term$) earliest=-30m | geonormalize | eval _geo_count=coalesce(_geo_count,1) | stats sum(_geo_count) as _geo_count by _geo How can I make this work? Anthony ... View more

Hi, Currently, our jobs directory is more than full. To fix this, we wanted to change the expiry time of jobs so they would be deleted from the jobs (as we have no need for historic ones to be stored at all). However, setting the dispatch.ttl doesn't appear to have fixed this. We have the following setting for a saved search: [test_page_pivot] action.email = 1 action.email.inline = 1 action.email.sendresults = 1 action.email.subject = TEST Splunk Alert: $name$ action.email.to = xxxxxxxxxxx@gmail.com alert.digest_mode = True alert.expires = 30m alert.severity = 1 alert.suppress = 0 alert.track = 0 auto_summarize.dispatch.earliest_time = -1d@h cron_schedule = */10 * * * * dispatch.earliest_time = -24h@m dispatch.ttl = 1p enableSched = 1 search = | pivot TEST_page_pivot TEST_page_object count(TEST_page_object) AS "Total" SPLITCOL platform SPLITROW app_id AS "app_id" | search app_id="*" | rename VALUE AS unknown | addtotals As you can see, dispatch.ttl is set to 1p for this query which runs every 10minutes. Therefore it should be reaped from the jobs after 10minutes, however this is not the case . Inside jobs, the expiry time keeps being extended, even if it initially shows the expected expiry time. What's causing this? ... View more

Hi, I'm currently looking at partially complete logs, where some contain an article_id, but some don't. Is it possible to take a value from a different field (video_id) to populate that field when is it null? Currently I'm trying to use this query: index="video" | fillnull value=video_id article_id Obviously it's intended to put the value from the video_id into article_id where article_id is null, but it only puts the string "video_id" instead. Is there a way around this? Anthony ... View more

I currently have a simple constraint in a pivot datamodel which is: index=video earliest=-5h-1d@d+5h latest=-5h@d+5h This query by itself returns results. However, when put as a constraint in a pivot and then querying by the pivot, no results are returned if the pivot is accelerated. Removing the acceleration however means results come through. What can cause issues like this with accelerated pivots? Anthony ... View more