The problem that you are having is that you do not have any tiles set. Without tiles, zooming to near-ground level is useless because there is no detail to render so all you will see is white blankness. Therefore Splunk refuses to zoom down any lower. This is all proper and good, except that there is nothing that explains this to you, thus your confusion. The fix is easy: simply, Edit your dashboard, click the painbtrush icon to open the Format dialog, click on the Tiles tab/section and examine the URL setting, which starts out blank. Directly below this setting is a note with a sample URL to use for tiles. Copy this URL and paste it into the URL text box and save. You now have tiles and detail to render so zoom will function. ... View more

Hello, Maybe you can try this? iplocation src_ip | stats sparkline count, dc(src_ip) by Country | sort - count | head 10 Kind regards, Willem ... View more

I got this working just after I asked the question... Solution: | eval threshold=case(threshold < overalMean*0.05, 0, threshold > overalMean*0.05, threshold) ... View more

Hello, I figured this out and if someone would need the answers: This does not double license costs The S3 bucket is accessable without Splunk Kind regards, Willem ... View more