I'm not sure if this is the right way to do what I want, but we are trying to build dashboards for users that look at a live tail of a log at the moment and they will do something (create a ticket, call someone) if a certain pattern (an error/warning) pops up.
In the end I would like to have saved searches that will do the pattern spotting, but to show that splunk is actually capable of recognizing those patterns I thought that highlighting keywords in different colors doing a realtime search could help.
On top of that it might be easier to define the exact patterns that a savedsearch will have to recognise. Right now there is still a lot of "unconscious knowledge in the air".
Such as: If error x and two errors y appear within 30 seconds then action z has to be taken. But when the search is built it turns out that there also needs to be a warning y with keyword b. I'm hopin that eventually all this knwoledge that the people built up over years can be transparently moved to queries working together with those users.
Thank you for your feedback.
Chris
