You should try this https://community.splunk.com/t5/Knowledge-Management/Solutions-quot-Splunk-could-not-get-the-description-for-this/td-p/694752 ... View more

Thanks for your answer. For the moment, I accept the situation for what is. I didn't came up yet with tailing the log but that isn't a bad idea at all and will consider implementing it when I'm done with the Must-have requirements 🙂 ... View more

Thanks Ziegfried for your fast response! With the query showed below Splunk makes a correct mapping altough I am going to try as well to use Lookups with CSV files to map the different events as the subsearch has a bad influence on the loading performance. index=syslog | join src_mac usetime=true earlier=true [ search index=main sourcetype=dhcp_log src_ip= src_mac= | fields _time src_ip src_mac ] ... View more

Thanks for your reply. At then end I used Sideview Utils to extract the results. <view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False"> <label>IP / MAC</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="HTML" layoutPanel="viewHeader"> <param name="html"><![CDATA[ <h1>Lookup IP and MAC addresses</h1> ]]></param> </module> <module name="TextField" layoutPanel="panel_row1_col1" autoRun="False"> <param name="name">selectedReport</param> <param name="label">Lookup IP/MAC</param> <module name="Search" layoutPanel="panel_row2_col1" group="Device information"> <param name="search">sourcetype=DHCP_Log AND (src_ip = $selectedReport$ AND src_mac != '') OR (src_ip != '' AND src_mac = $selectedReport$) | head 1</param> <param name="earliest">-120min</param> <module name="HTML"> <param name="html"><![CDATA[ <div>IP Address: $results[0].src_ip$<br /> MAC Address: $results[0].src_mac$<br /> </div> ]]></param> </module> </module> </module> ... View more