topic Re: How can I search for the field host with multiple values? in Getting Data In

How can I search for the field host with multiple values?

ddrillic — Wed, 26 Sep 2018 15:19:15 GMT

We ended up with an operation index that has two hosts per event, let's say aaa and bbb.
Searching for index=shortland host=aaa brings results but index=shortland host=bbb does not.

What can it be?

Re: How can I search for the field host with multiple values?

richgalloway — Wed, 26 Sep 2018 15:48:20 GMT

Can you share a sample (sanitized) event, please?

Re: How can I search for the field host with multiple values?

harishalipaka — Wed, 26 Sep 2018 16:40:59 GMT

Hi @ddrillic

H can achieve with OR ,IN
EG:- host=aaa or host=bbb

host in ("aaa","bbb")

If my answer helped please accept answer or up vote

Re: How can I search for the field host with multiple values?

ddrillic — Wed, 26 Sep 2018 17:01:08 GMT

No worries - speaking with the sales engineer who explained that one host value was indexed at index time and another one was discovered at search time. Apparently, only the index time value is searchable when searching against the host field.

Re: How can I search for the field host with multiple values?

ddrillic — Wed, 26 Sep 2018 17:01:32 GMT

Thank you @harishalipaka.

Re: How can I search for the field host with multiple values?

ddrillic — Sat, 06 Apr 2019 21:47:57 GMT

For the record, a similar case at How to handle search query when json data has host field?

Re: How can I search for the field host with multiple values?

woodcock — Sun, 07 Apr 2019 01:49:32 GMT

If that search does not work, then your host field does really have both values. We will never get to the bottom of this unless you post an event. and your props.conf settings.