My search results still seem to be staying static, rather than using the latest instance of the saved search results for post processing. The panels refresh but the post processing searches dont rerun to generate latest results ... View more

Are you trying to use HTTPS for the hosts without certificates? Have you tried just connecting with standard HTTP to the hosts behind the load balancer? We have a similar scenario for our web service endpoints. Only the externally accessible LB is has a server certificate, which you can connect via HTTPS to monitor, but to monitor the host endpoints directly we use HTTP. ... View more

Is this returned in a single event or two separate events? i.e: event 1 = [1421755004] SERVICE ALERT: oradb4;Bond1 TX;CRITICAL;SOFT;1;CHECK_NRPE: Socket timeout after 10 seconds. event 2 = [1421755004] SERVICE ALERT: nagios;Eth0 TX;WARNING;SOFT;1;WARNING: Uso de eth0 para TX: 11167 kb/s or event 1 = [1421755004] SERVICE ALERT: oradb4;Bond1 TX;CRITICAL;SOFT;1;CHECK_NRPE: Socket timeout after 10 seconds. [1421755004] SERVICE ALERT: nagios;Eth0 TX;WARNING;SOFT;1;WARNING: Uso de eth0 para TX: 11167 kb/s If these are two events, limit the results of your search to exclude the unwanted event index=your_index "your search criteria" "SERVICE ALERT: oradb4*" etc. If it is a single event then you can end the event using a transaction index=your_index "your search criteria" "SERVICE ALERT: oradb4*" | transaction endswith="Socket timeout after 10 seconds." ... View more

When the transaction is made |transaction ID MCN| or | transaction ID MCN startswith="begin.action" endswith="end...action" it grabs the events with the matching fields for ID and MCN So in case 1 ID and MCN match on lines 1 + 4, and 2 + 3. The duration is calculated from the difference between the first event and last event in the transaction. e.g line 4 time - line 1 time = duration. Case 2 should match lines 1+2 and 3+4. You can read more here: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/transaction ... View more

Updated my answer above. Let me know how it goes. ... View more

Option 1 was close, but had issues if a user input other than * is specified. For searches when no user input is specified it works perfectly (as * is default value). Option 2 was easiest for me to use as I just assigned FIELD2 = "" and could then leave my search string logic as it was. Thanks for the help. ... View more

Revisted this after Xmas and managed to get this working correctly with sub search. There was an issue with my main search string throwing off my results. Thanks for the help ... View more

This is getting closer thanks! Though I have a couple of bumps that need ironing out. Checking the search job inspector, I can see that it has evaluated the subsearch expression and has found the correct value, and incorporated into my main search - perfect. Though I'm returning no results...doh. I think it might be because the field name I am using. When I find the track trace initially, it comes from an xml field named , which I was calling tracktrace in my rex. However when I am using that value to find the appropriate logs in my main search the xml field name is . The subsearch then goes looking for tracktrace="M40GW2014092911354947166" which can't be found. Can I somehow still use the value/result (M40GW2014092911354947166) from the subsearch and populate that into the main search in a way that it can find the event i.e. If I just type into search "M40GW2014092911354947166" it would return the correct event. Or am I naming the field incorrectly that I could do another way? Currently: rex "(?i)'<'ns2:MessageTrackTrace'>'(?P'<'tracktrace'>'[^<]+)" without internal ' ' on arrows. ... View more

Yes and it wasn't successful. The information I want to ultimately find/display is in a separate event to where I initially pick up the tracktrace value. As the user wouldn't have the tracktrace to return the required results, the purpose of the form is to find the tracktrace for them from information they do have. Then perform a search based off that tracktrace to return the desired information. Some code was trimmed out of my initial post, but basically: Search 1 takes two token inputs from text fields and completes the appropriate search to return event that contains the track trace. The track trace value is then extracted. I then need to perform another search with this value to find the event with results they are looking for, and extract/display the field. ... View more