Thanks Archana. Just to clarify for others, the search has to be run from inside the Web Intelligence App. The 'web-traffic' eventtype is not defined in the standard search app. ... View more

Hi Chris, As I understand the documentation, the savedsearch is run from the search window in the UI. From http://docs.splunk.com/Documentation/WebIntel/latest/User/Definingsitesources: First, run the saved search called "Sourcenames Lookup" to populate the lookup table. You can run this search from the Search view: | savedsearch "Sourcenames Lookup" However, when I run it I get no results, not sure what the problem is...anyone have an idea why or what to try next? Thanks, -greg ... View more