topic Re: Search command for different PC's in Splunk Search

Search command for different PC's

Rhuen — Wed, 21 Mar 2012 11:55:49 GMT

Hy,

i have create a Dashboard with Error Logs.
1 for all pc's: Computername="*", it works, i see all PC's but which command is the right to see only 2 or 3 PC's with Computername:
Client1 and Client2?!
I was try:
...Computername="Client1,Client"...Computername="Client1" Computername="Client2"...and so on, nothing is working.

I know it works with "Client*" then i see Client1, and Client2, but the Computernames are MAC-Adress...Client1 and Client2 name is only a example.

I hope you know what i mean :-).

This are my complete search string:

source="WMI:WinEventLog:*" ComputerName="*"  | stats count count(eval(Type="Warnung")) as warnings count(eval(Type="Fehler")) as errors by host

greets.

Re: Search command for different PC's

Ayn — Wed, 21 Mar 2012 13:34:33 GMT

If you want to search for multiple values of ComputerName you could just OR them together:

ComputerName="Client1" OR ComputerName="Client2" OR ...

Re: Search command for different PC's

Rhuen — Wed, 21 Mar 2012 13:56:36 GMT

Haha omg you right Ayn 🙂 so simple, thx.

Re: Search command for different PC's

jtrimmi1 — Mon, 06 May 2019 15:24:07 GMT

I think now you can do something like this :

source="WMI:WinEventLog:*" ComputerName IN ("Client1","Client2","Client3","Client4")