Hi, I am trying to figure out how to achieve something and would appreciate any help from your experience. I have a view showing some search results. There are two extracted fields. One is source IP address and the second is destination IP address. Now let's say I search for all events that have a certain destination IP address. I can easily get all extracted source IP addresses. Now the tricky part: I want to search for all events with the extracted source IP address and for those events extract all destination IP addresses. Today I need to do this manually, copy each source IP into a new search, extract the destination IPs and then again copy them one by one into a new search. Is there an easier way to do this? If not, is it possible to add this functionality by myself? Thanks for the help! ... View more

Hi, My event data consists of HTTP requests. My goal is to build a view that includes: 1) A drop down to choose a Host header value 2) A line chart for the selected Host header related events that displays the number of unique requests for each source IP each day 3) Another chart that displays another flavor of the data When trying to do this with a search form I hit a wall when trying to take the form search results and get something else out of them. The basic search results are the requests associated with a certain Host header value and I was trying to create a chart for the number of unique page hist by IP. I did this by adding a chart where charting.data.search="timechart span=1d count(url) by source_ip". This did not work and the chart was not displayed correctly, making me think that this is not the way i was supposed to use charting.data.search. So the question is what is the best way to build such a screen (form or view) and how do i achieve that (did not find the documentation taking me through this). Thanks! ... View more

Hi, I am using time consuming searches and i was wondering if and how is it possible to run the searches in advance and then access the cached search results without running the search again. I saw the saved searches option but i was not sure whether they accomplish what i am looking for. Thanks for your help! ... View more