Hi all, regarding a complete monitoring for our customers we want to detect if a subsearch is finalized. If this happens the search results of the corresponding main search could be incomplete. Especially for scheduled searches, where no user gets a feedback, this would be helpful. Is there any log channel, where this is logged? I tried starting splunk in debug-mode but found nothing. The only place are the search-logs, but indexing every search-log seems a bit oversized. Any one out there who could provide a hint? Thanks! ... View more

Hey, I developed a dashboard which analyzes failed logons of user on a systems with different operating systems. This is my XML: <form> <label>Fehlanmeldungen auf einem System</label> <fieldset autorun="true"> <input type="radio" token="userType"> <label>User</label> <default>natural</default> <choice value="natural">J-User</choice> <choice value="tech">technische User</choice> </input> <input type="radio" token="os"> <label>Betriebssystem</label> <default>Linux</default> <choice value="aix">AIX</choice> <choice value="linux">Linux</choice> <choice value="solaris">Solaris</choice> <choice value="windows">Windows</choice> </input> <input type="text" token="ip" searchWhenChanged="true"> <default>*</default> <label>Quell-/Zielhost</label> </input> <input type="text" token="user" searchWhenChanged="true"> <default>*</default> <label>User</label> </input> <input type="time" token="timerange"> <label>Zeitraum</label> <default> <earliest>-7d@d</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <table> <title>Fehlanmeldungen von $userType$-Usern auf dem $os$-System mit der IP-Adresse $ip$ der letzten 7 Tage</title> <search> <query>| savedsearch fi_UI_MoOpS_failed-logons-$os$-$userType$ ip=$ip$ user=$user$</query> <earliest>$timerange.earliest$</earliest> <latest>$timerange.latest$</latest> </search> <drilldown> <condition field="UserID"> <set token="form.ip">*</set> <set token="form.user">$click.value2$</set> </condition> <condition field="Zielsysteme"> <set token="form.ip">$click.value2$</set> <set token="form.user">*</set> </condition> <condition field="Quellsysteme"> <set token="form.ip">$click.value2$</set> <set token="form.user">*</set> </condition> <condition field="*"> <set token="form.ip">*</set> <set token="form.user">*</set> </condition> </drilldown> </table> </row> </form> When I click on a userID or a system IP, the input values change, like I expect them to do. The search restarts with new parameters. Now the problem: When I start the drilldown from the first page of the result table on this form everything works fine. But when I select a userID from another page than the first, the tokens were set correctly and the search restarts too, but it displays "no results found". In search view the same search gives me the expected result and in the inspector the resultcount of this drilldown is 1, like I expect. Is it a problem of displaying the results caused by the JS, because it is only loaded correctly on the first result page? I know, that it is possible to rewrite the drilldowns with links to the same page, but then the whole page reloads and I don't want the page to do this, because of usability etc. Does anyone has an idea, why an drilldown from the first result page in the table is working fine but from any other result page in the table isn't? Every little hint can help. Thank You! ... View more