thanks a lot for your tips! Unfortunately I didnt phrase my question correctly. The problem is that I dont know whats in the msg field. The lines above are just anonymised examples. There are more than 500 different messages coming from various autonoumus monitoring systems where each individual admin could change a message any time. Our main goal is to identify similar messages/events which are affecting more than one service. For example similarity would mean to us at least 3 words are matching or 1 word matching and number of words are equal. ... View more

the newly created log file is named with the actual date so names are always uniqe. Thats the std. tomcat accesslog mechanism I think. D:\\Program Files\\Apache Software Foundation\\Tomcat7.0\\logs\\localhost_access_log.2018-11-28.txt Also splunks lists the new file as source in web search but theres no log entry indexed. ... View more

@martineisenkoelbl you can create your Splunk Dashboard the way you want and then check out Smart PDF Exporter for Splunk App which would allow you to schedule such Dashboard. ... View more