Hello everyone,   I am still relatively new to Splunk. I would like to add an additionalTooltipField to my maps visualization, so that when you hover over a marker point, more data details about the marker appear. I have formulated the following query: source="NeueIP.csv" host="IP" sourcetype="csv" | rename Breitengrad as latitude, L__ngengrad as longitude, Stadt as Stadt, Kurzbeschreibung as Beschreibung | eval CPU_Auslastung = replace(CPU_Auslastung, "%","") | eval CPU_Auslastung = tonumber(CPU_Auslastung) | eval CPU_Color = case( CPU_Auslastung > 80.0, "#de1d20", CPU_Auslastung > 50.0, "#54afda", true(), "#4ade1d" ) | table Stadt, latitude, longitude, Kurzbeschreibung, Langbeschreibung, CPU_Auslastung, CPU_Color | eval _time = now()     And I tried to adjust some things in the source code so that the additionalTooltipField appears. Last of all: "visualizations": {  "viz_map_1": {  "type": "splunk.map",  "options": {  "center": [  50.35,  17.36  ],  "zoom": 4,  "layers": [  {  "type": "marker",  "latitude": "> primary | seriesByName('latitude')",  "longitude": "> primary | seriesByName('longitude')",  "dataColors": ">primary | seriesByName(\"CPU_Auslastung\") | rangeValue(config)",  "additionalTooltipFields": ">primary | seriesByName(\"Stadt\")",  "markerOptions": {  "additionalTooltipFields": [  "Stadt",  "Kurzbeschreibung"  ] },  "hoverMarkerPanel": {  "enabled": true,  "fields": [  "Stadt",  "Kurzbeschreibung"  ]  }  }  ]  },   My sample data is as follows: Stadt, Breitengrad, Längengrad, Kurzbeschreibung, Langbeschreibung, CPU_Auslastung Berlin, 52.52, 13.405, BE, Hauptstadt Deutschlands, 45% London, 51.5074, -0.1278, LDN, Hauptstadt des Vereinigten Königreichs, 65% Paris, 48.8566, 2.3522, PAR, Hauptstadt Frankreichs, 78%     Is my plan possible?   Thanks for your help in advance!!   ... View more

Hello all, I am still relatively new to the topic of Splunk and SPL. To show the maximum uptime per day of four hosts in a bar chart, I wrote the following query: sourcetype=datacollection VMBT02 OR slaznocaasevm01 OR VMMS01 OR slaznocaasmon01 | rex "Uptime: (?<hours>\d+) hours (?<minutes>\d+) minutes" | rex "Uptime: (?<minutes>\d+) minutes (?<seconds>\d+) seconds" | eval hours = coalesce(hours, 0) | eval minutes = coalesce(minutes, 0) | eval seconds = coalesce(seconds, 0) | eval uptime_decimal = if(minutes > 0 AND seconds > 0, minutes/1000 * 10, hours*1 + minutes/100) | eval formatted_uptime = round(uptime_decimal, 2) | where extracted_hostname IN ("VMBT02", "slaznocaasevm01", "VMMS01", "slaznocaasmon01") | stats max(formatted_uptime) as Uptime by extracted_Hostname I extracted the field "extracted_hostname" via the GUI before. There are also no events here that do not match the regex. Afterwards, the chart is also displayed correctly. However, the field extraction does not work from the 01st to about the 10th of a month. Instead of the hostnames, other data fragments from the first line of an event are taken here. I can't see a pattern here either. Does anyone know where the causes for the incorrect extraction are? Is perhaps my query incorrect? I hope someone can help me to solve this problem. Thanks in advance Many greetings ... View more