Hi Splunk Community! I have a line chart of some values over time grouped by fieldA and so by default there is a legend that indicates the unique values from fieldA by color. May i know how i can just have the line chart without the legend? How should i hide the legend? Thanks in advance! ... View more

Hello Splunk Community! Regarding extract new fields in splunk search, what's the lifespan of the new created fields? will be available after re-login and available to all users? and can be easily removed later? thank you in advance! ... View more

Hello Splunk Community! I have a query where im extracting data from different logs and displaying them on the same row in a statistical table. here is my code:   index=main source=/opt/server/*/*userauth* | rex field=_raw "\]\s\S+\s-\s\[(?<caller>\S+)\]\s\S+->(?<function>\S+)\s(?<logs>.+)\:\s\[(?<value>\S+)\]" | where isnotnull(caller) | chart values(value) over caller by logs useother=f   i used the chart command to turn the logs  into column headers with their respective values The result : caller logB logC logD caller_id valueB valueC valueD however, when i narrow down the search by adding "validateSB" which is contained in most log entries,   index=main source=/opt/server/*/*userauth* validateSB | rex field=_raw "\]\s\S+\s-\s\[(?<caller>\S+)\]\s\S+->(?<function>\S+)\s(?<logs>.+)\:\s\[(?<value>\S+)\]" | where isnotnull(caller) | chart values(value) over caller by logs useother=f    The column A now appears as a column header with its respective value. caller logA logB logC logD caller_id valueA valueB valueC valueD When i also search a specific caller, the column A appears with its respective value too. Anybody know why this might be the case? Thanks in advance! ... View more