Here is what I did for v9.1.5 Add CSS to /opt/splunk/share/splunk/search_mrsparkle/exposed/build/css/bootstrap-dark.css /opt/splunk/share/splunk/search_mrsparkle/exposed/build/css/bootstrap-light.css ------------------ /* The switch - the box around the slider*/ .autoexpand { margin-top: 2px; } .autoexpandtext { margin-right: 5px; } .switch { position: relative; display: inline-block; width: 43px; height: 18px; margin-top:5px; margin-bottom:0px; } /* Hide default HTML checkbox */ .switch input { opacity: 0; width: 0; height: 0; } /* The slider */ .slider { position: absolute; cursor: pointer; top: 0; left: 0; right: 0; bottom: 0; background-color: #ccc; -webkit-transition: .4s; transition: .4s; } .slider:before { position: absolute; content: ""; height: 10px; width: 10px; left: 4px; bottom: 4px; background-color: white; -webkit-transition: .4s; transition: .4s; } input:checked + .slider { background-color: rgb(92, 192, 92); } input:focus + .slider { box-shadow: 0 0 1px #2196F3; } input:checked + .slider:before { -webkit-transform: translateX(26px); -ms-transform: translateX(26px); transform: translateX(26px); } /* Rounded sliders */ .slider.round { border-radius: 34px; } .slider.round:before { border-radius: 50%; } In /opt/splunk/share/splunk/search_mrsparkle/exposed/build/pages/dark/search.js /opt/splunk/share/splunk/search_mrsparkle/exposed/build/pages/light/search.js search for "pull-right jobstatus-control-grouping" and add this text in that div element ----------------- <div class="autoexpand"><span class="autoexpandtext">AutoexpandJSON</span><label class="switch"><input type="checkbox" checked><span class="slider round"></span></label></div> ------------------ In the same search.js files  /opt/splunk/share/splunk/search_mrsparkle/exposed/build/pages/dark/search.js /opt/splunk/share/splunk/search_mrsparkle/exposed/build/pages/light/search.js add this scripts to the bottom ------------------ let autoExpandPropertyName='jsonAutoExpand'; let autoExpandSetting = localStorage.getItem(autoExpandPropertyName); let observer2Added =false; $(document).ready(function() { if (autoExpandSetting === null) { localStorage.setItem(autoExpandPropertyName, '1'); autoExpandSetting = '1'; } if(autoExpandSetting === '1') { function autoExpand(){ // console.log("autoExpand started"); $(".jsexpands").each(function() { if($(this).html() == '[+]') { $(this)[0].click(); } })}; setTimeout(()=> { console.log("Delayed"); // select the target node var target = $(".shared-eventsviewer")[0]; console.log(target); // create an observer instance var observer6 = new MutationObserver(function(mutations) { mutations.forEach((mutation) => { if (!mutation.addedNodes) return autoExpand(); $(".events-controls-inner").click(); //does not refresh table if missing }) }); // configuration of the observer: var config = { attributes: false, childList: true, characterData: true, subtree:true}; // pass in the target node, as well as the observer options observer6.observe(target, config); }, "500"); } function toggleAutoexpand(mutation){ const slider = document.querySelector('.slider'); if (slider === undefined ||slider === null) return; if(observer2Added) return; observer2Added = true; if(autoExpandSetting === '0') { $(".switch")[0].childNodes[0].checked =false; } slider.addEventListener('click', () => { let storageValue = localStorage.getItem(autoExpandPropertyName); if ( storageValue === '1') localStorage.setItem(autoExpandPropertyName, '0'); else localStorage.setItem(autoExpandPropertyName, '1'); location.reload(); }); observer2.disconnect(); }; let observer2 = new MutationObserver((mutations) => { mutations.forEach((mutation) => { if (!mutation.addedNodes) return toggleAutoexpand(mutation); }) }) setTimeout(()=> { observer2.observe($(".shared-eventsviewer")[0], { childList: true , subtree: true , attributes: false , characterData: false }) }, "500"); }) ------------------ To refresh the splunk css and js caching use link: https://yourinstance:8000/en-GB/_bump On the next splunk update you have to repeat the process if everything remains the same. I couldn't find any other way. ... View more

it's not working for me, as i said below, i believe there is something wrong going on with my cluster and config files. as soon i find a solution and this work i'll mark it as working thank you this is how it looks like link text ... View more

I don't see how this "works in regex101"? The match ends somewhere in the middle of the query: https://regex101.com/r/EQXG0e/1 This might work: ,"sql_queries":".*?," https://regex101.com/r/EQXG0e/3 (as double quotes seem to be escaped inside the query), but not sure if that is perfectly reliable, I don't have access to pastebin here, so can only see the small sample put into regex101 by one of the other commenters. And can you share in what sense it is not working in Splunk? Is it not stripping anything, or is it stripping too little / too much in certain cases? ... View more

i tried with a new log file and it works and i can extract all fields except the queries which is always the last lines, basically all the queries are in a new line and splitted in multiple lines like: ProxySQL LOG QUERY: thread_id="43" username="redacted" schemaname=information_schema" client=redacted:51827" HID=1 server="redacted:3306" starttime="2019-01-24 10:37:20.959324" endtime="2019-01-24 10:37:21. 47135" duration=87811us digest="0x8D9F0318EE412645" select date_format(t.redacted,'%d-%m-%Y') date, t.redacted,t.redacted, c.redacted, c.description, CASE when t.redacted = 'redacted' then redacted else ppcustom_field end Ref, t.redacted, t.net_amount, t.redacted from redacted.redacted c, redacted.redacted t where c.redacted = t.redacted -- and t.redacted is not null and t.redacted >= '2019-01-23 00:00:01' and t.redacted < '2019-01-24 00:00:01' order by 2,1,4,6,5 i don't know how to write a regex to extract that, i can't do ^select because it could be a query update. what i am sure is the query is always after the digest field. ... View more

yes perfect thanks! ... View more

Glad to hear that. Please mark the answer as accepted, so it is clear for others that this question is answered 🙂 ... View more

well that did the trick! Thanks now i need to parse the nested list inside the same line. i'll have a look around here propably there is already the answer i am trying with spath but is not working i got something like: {"class":"EventsWorker","args":["{\"id\"=187918,....] i can't extract args, i tried: mysearch | spath path=args{} output=args ... View more