Hello all,  I wanted to share my recently published Splunk extension for Chrome and Edge. This extension is free and enables several features: Code commenting with Ctrl + / Comment collapsing/folding Saving and retrieving queries Inline command help You can check it out at Splunk Search Assistant (google.com) Julio ... View more

Hello everyone,  I have been working on a Chrome/Edge extension to enable some enhancements in the Splunk SPL search box. Initially, my goal was to enable the ability to toggle comments on and off using Ctrl+/, which is common in most code editors, but I also added other features; like the ability to cut lines using Ctrl+x or toggle showing line numbers with Ctrl+l. You can check out the extension at github. There I provide detailed installation instructions.  I am looking forward to any feedback, questions or suggestions. Thanks, Julio ... View more

Hello all,  This is my first post here. I have been learning Splunk over the past few months and I am loving it.  I am running in to an interesting issue.  I am using the transaction command to group events together.  An example of the queries below: index::web ealiest=-30m | transaction maxspan=3s result:  STARTED RECORD UPDATE: {"update"=>"contacts", "ordered"=>true, "updates"=>[{"q"=>{"_id"=>BSON::ObjectId('123456789')} COMPLETED record update {"status": 200} But if I append a table command to display the _raw field some of the characters are automatically encoded, as shown below: index::web ealiest=-30m | transaction maxspan=3s | table _raw result: STARTED RECORD UPDATE: {"update"=>"contacts", "ordered"=>true, "updates"=>[{"q"=>{"_id"=>BSON::ObjectId('123456789')} COMPLETED record update {&quotstatus&quot: 200}   I tried recreating this behavior by using makeresults, but in that case it works as I would expect. Does anyone have an idea of why this might be happening?    Thanks, Julio ... View more