What's New in 4.2.0

This release changes the default map tile provider to fix active tile blocking issues, adds automatic dark theme map support, polyline rendering for GeoJSON feature layers, removes a misleading refresh option, and fixes two quality-of-life issues.

Default Map Tile Provider Updated

Maps+ now defaults to CartoDB Light instead of OpenStreetMap for new installations and unconfigured dashboards.

OpenStreetMap's tile servers are a community-funded resource with a usage policy that requires tile requests to identify the calling application. Splunk's dashboard rendering environment does not send the identification headers OSM requires, which can result in tiles being blocked without warning — which is likely what brought you to this release.

CartoDB Light is a clean, visually neutral base map with no API key required and terms of service compatible with embedded Splunk dashboard use. It covers the same zoom levels and geographic extent as OpenStreetMap.

If you use OpenStreetMap tiles today, no action is required — your dashboards have an explicit tile selection saved and will continue to load OSM tiles as configured. OpenStreetMap remains available in the Map Tile dropdown.

Dark Theme Map Auto-Selection

Maps+ now automatically uses a dark base map when Splunk's dark theme is active. Previously, the light CartoDB base map was always used regardless of theme, producing a jarring light map on a dark dashboard.

If you have already selected a specific map tile in the Format panel, your selection is always respected — the auto-selection only applies when the Map Tile option is still at its default value.

No configuration required. Switch to Splunk's dark theme and the map follows.

GeoJSON Feature Polylines

The feature field now supports open polyline rendering for multi-point geometries. Set featureFill=false on your SPL rows to render a line instead of a closed polygon:

| eval feature="lat1,lon1;lat2,lon2;lat3,lon3", featureFill="false"

Previously, all multi-point features always rendered as filled polygons. Single-point features (circle markers) and polygon features are unaffected.

Dashboard Refresh Interval Removed

The Dashboard Refresh Interval option has been removed from the Format panel.

This feature forced a full browser window reload rather than refreshing the individual map panel, which disrupted every other panel on the dashboard simultaneously. It was a workaround for a limitation that no longer applies in Splunk 10.

Replacement: use Splunk's native panel refresh instead. Add a <refresh> tag directly to your panel's search element in the dashboard XML:

<search>
  <query>| your SPL here</query>
  <refresh>30s</refresh>
  <refreshType>delay</refreshType>
</search>

This refreshes only the map panel on the specified interval without affecting anything else on the dashboard.

Migration: if you currently have a Dashboard Refresh Interval value set, the stored value will be silently ignored after upgrading. Add the <refresh> tag above to your panel XML to restore the behavior correctly.

Bug Fixes

Path layer control labels: Path layers without a layerDescription field now show a readable Path: <identifier> label in the layer control instead of the raw field value (IP address, hostname, or similar).

Dark theme coordinate dialog: The coordinate dialog (opened from the right-click context menu) now correctly styles its input fields for the dark theme. Previously, input text was invisible against the black dialog background.

Upgrade Notes

Fresh installs will default to CartoDB Light
Existing dashboards with a saved Map Tile selection are unaffected
The Dashboard Refresh Interval option is removed — see migration note above if you use it
No other SPL changes required
No other Format panel changes required

Maps+ for Splunk

5

#32