I have configured props.conf and transforms.conf on a Heavy Forwarder in order to split an existing sourcetype into sub categories. I have utilized what appears to be the general convention for naming layers in sourcetypes ie: a:b:c:d. Now, the sourcetype I am splitting is a:b which are generating a:b:c and a:b:c:d. Everything is working fine and I am getting the data into the indexes and the formatting is perfect. What is bothering me is that in order to search for the a:b:c and a:b:c:d source I have to use a trailing wilcard. As a:b:c and a:b:c:d each contain quite a bit of data I would like to look at either or. Its in no way a show-stopper but I would just like to check if I have missed something with regards to the config or if this is just the way it is. props.conf [a:b] TRANSFORMS-changeSourceType = set:a:b:c, set:a:b:c:d BREAK_ONLY_BEFORE = (%)|(VOIP_CALL_STATISTICS) transforms.conf [set:a:b:c] DEST_KEY = MetaData:Sourcetype REGEX = (%VOIP) FORMAT = a:b:c [set:a:b:c:d] DEST_KEY = MetaData:Sourcetype REGEX = (VOIP_CALL_STATISTICS)|(DSP) FORMAT = a:b:c:d Edit: After some further investigations it gets even stranger where I have to include a search word in order for data to displayed in addition to the trailing wildcard: index=something sourcetype=a:b:c:d* gives no results. index=something sourcetype=a:b:c:d* foo gives results containing foo . I forgot to mention I am running version 6.5.0. ... View more

Hi, I am trying to display a blob on a map in a view created with the Sideview Utils Sideview Editor. I have a search which populates the correct data so it is presentable by for example HERE Maps and the built-in maps in Splunk. However, I am unsure on how to implement this either by the Sideview Editor or in the XML. The layout of the map and the design of the blob is of minor importance I am (at first at least) only attempting to display the current location of a mobile device. Can anyone point me in the direction in order to get this work? ... View more