Hi @Ruben_sb1 .. "Embedding dashboards", outside of Splunk into our own html pages is an important feature lot of Splunk Customers use already. Pls check link given by above reply.. And pls note that this task may require some development exposure. Update us when you are stuck somewhere, someone will help you asap,.. thanks. ... View more

Hi @Ruben_sb1, you could save the results of the Alert's search in a lookup or (better) in a summary index. So you have an index that contains all the fired alerts to use for your searches, dashboards and alerts. You can easily reach this adding an action to your alert (Save in Lookup) or  (I usually prefer this solution) adding at the end of your alert "| collect index=my_summary_alerts_index". Ciao. Giuseppe   ... View more

I tried to fix it with forwarding the 514 port to 5514 but I can see only one log source I have validated that I receive the log source with tcpdump     ... View more

You understand it after you run only that sub search, read what the format do and then remember that sub search has run first. Basically the result of sub search has added to main search and then it has ran. r. Ismo ... View more