Good afternoon, I have a question on customizing trellis dashboard visualization. I want to remove the titles/categories on the second trellis visualization (the ones that are highlighted in yellow). Does anyone know if there is an option in SimpleXML to make this possible? Thanks, kind regards, Willem Jongeneel ... View more

Goodmorning, I have a question on the geostats command in combination with the clustermap visualization. Search looks like this | search terms & stats functions | geostats latfield=depotLatitude longfield=depotLongitude count This leads to three points on the map of the Netherlands. I cannot zoom in to the level of detail that I want. What can I do to increase the zoomlevel? Do I need to import some file in order to do so? Or should I change something in the search? Thanks in advance, kind regards, Willem Jongeneel ... View more

Hello, I've got a question on getting Splunk to extract key value pairs from syslog json events. The events look like this: <14>Mon Aug 12 12:29:29 UTC 2019Info: { //json part}\x00 At first I tried with the standard _json sourcetype. This didnt work. So I tried to make a custom sourcetype that would remove the part before and after the json. I've tried to add SEDCMD-end=s/\x00//g SEDCMD-start=s/^[^{]+//g KV_mode=json When I test the sourcetype using the add data wizard in Splunk web, I see the part before the json en after the json dissapear. After I changed the sourcetype to my custom sourcetype in the source of the data, this doesnt work and I still get events with the part before and after the json. The full sourcetype conf: ADD_EXTRA_TIME_FIELDS=True ANNOTATE_PUNCT=true AUTO_KV_JSON=true BREAK_ONLY_BEFORE_DATE=true CHARSET=UTF-8 DEPTH_LIMIT=1000 KV_mode=json LEARN_MODEL=true LEARN_SOURCETYPE=true LINE_BREAKER=([\r\n]+) LINE_BREAKER_LOOKBEHIND=100 MATCH_LIMIT=100000 MAX_DAYS_AGO=2000 MAX_DAYS_HENCE=2 MAX_DIFF_SECS_AGO=3600 MAX_DIFF_SECS_HENCE=604800 MAX_EVENTS=256 MAX_TIMESTAMP_LOOKAHEAD=128 NO_BINARY_CHECK=true SEDCMD-end=s/\x00//g SEDCMD-start=s/^[^{]+//g SEGMENTATION=indexing SEGMENTATION-all=full SEGMENTATION-inner=inner SEGMENTATION-outer=outer SEGMENTATION-raw=none SEGMENTATION-standard=standard SHOULD_LINEMERGE=true TRUNCATE=10000 category=Custom description=Sourcetype voor SAM, dit haalt de extra syslog informatie weg en toont alleen de JSON detect_trailing_nulls=false disabled=false maxDist=100 pulldown_type=true Extra information: This gets send to Splunk Cloud from a forwarder that receives this events over a TCP port. On the forwarder the port gets connected to the right index, and sourcetype. Can anyone advise me on how to get the key value pairs from these syslog/json events? Thank you in advance, kind regards, Willem ... View more