Hi @richgalloway  You are right. But dashboard is for mgmt to always visible if something is wrong or everything is fine. Seeking if someone is having a dashboard already.   Thanks,   ... View more

@PickleRick , Yes, agreed. ... View more

Hi @ww9rivers , Does Splunk supports this Add-on? because we are also facing issues while integrating with Cisco Estreamer with the same add-on. This add-on is developed by Cisco, as per my knowledge, Splunk support, will not support to troubleshoot. Thanks, Sandeep N ... View more

Richgalloway,   Thank you. will check the same ... View more

Unfortunately, at the moment Splunk cannot automatically extract the structured data if it's not the whole event (as in your case - the json part is preceeded by non-json header). There is an open idea for that https://ideas.splunk.com/ideas/EID-I-208 So far you can either parse the json part in search with help of the spath command as @VatsalJagani already showed or cut away the header part using SEDCMD or INGEST_EVAL (possibly extracting indexed fields if needed prior to removing the non-structured part). As a side note - you should _not_ use the _json sourcetype. Define your own ... View more