Hi Darren, thanks for your quick response. The subsearch basically works as expected. Unfortunately it fails if a transaction is not closed because there is a "Start exclude messages" event without matching "End exclude messages" event or vice versa. Also I could not get the proposed combination of main search and subsearch working. If I directly apply the syntax as I receive an error: Search Factory: Unknown search command 'index'. However when I add the search keyword to the subsearch index=IndexWhereTheDataIs sourcetype=SourcetypeWhereTheDataIs [ search index= ... the search result is empty and I could not figure out why since when I execute the searches separately and add the result of the subsearch manually to the main search, it works like a charm. ... View more

This is an ugly hack. You modify the original Splunk application. This should be done using an app, or even better there should be a built in setting to configure this. ... View more

CSS is made for styling not for security. It's like putting the key under the mat. ... View more