Yes, it is possible. You will need to join data from your log with the tagging data output from source=ec2_instances. So if the hostname was both in the host field of your log and in a tag of the EC2 instance labeled hostname, you could do something like: source="/var/log/messages" ERROR | eval tags.hostname = host | join type=left tags.hostname [search sourcetype="aws:description" source=*ec2_instances* earliest=-60m | fields tags.hostname tags.owner] Then you will have your ERROR message with the tags.owner field you need to escalate the alert. You could pass the event to a script that knows how to process that field appropriately or do a lookup to find the e-mail address. Left join since when the join fails you probably still want to proceed with a default escalation. ... View more

You can use the dedup command to only keep 10 of each sourcetype, returning the full events: * | dedup 10 sourcetype ... View more

The transaction command can group these events together into one event based on a common field: | transaction T | table T S demoval anotherdemo lastdemo Then you can create a table with rows that have the common T values alongside the S, demoval, anotherdemo, and lastdemo values there were previously part of separate events. http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Transaction ... View more

After talking to our technical account manager, this is the solution we came up with, it works very well: We run a scheduled search every five minutes on the search head, that gets the complete list of deployment clients from our deployment server (replace deploymentsever with the host name of your deployment server, or use local if it's the same as your search head) and then stores them in a static lookup file. | rest /services/deployment/server/clients count=0 splunk_server=deploymentserver | fields hostname name | rename name as clientName | outputlookup clientNames.csv Then we add the below stanzas to props.conf and transforms.conf so all messages get their clientName looked up based on their host: props.conf: [host::*] LOOKUP-client = clientLookup hostname AS host OUTPUT clientName transforms.conf: [clientLookup] filename = clientNames.csv And now, we can simply type clientName=new_web_app into the Search app, and all of our logs from that app will come up. Works great, and haven't seen any noticeable performance hit from the extra lookups. ... View more