Need a query /dashboard that shows hostnames from /var/log/messages

[dops1992]

We have an index called syslog and we want to capture certain errors and report them in a dashboard with a graph as well as a table below that . Was wondering how to do that . I tried to add a dashboard and a panel but it only shows the graph.

Example

index=log host=pprdabcdek01 "reports path is down" this works great for one host
index=log host=pprd*k* OR host=pprd***l "tur checker reports path is down"| timechart count by host (This also works great but not sure if it is efficient) . Woudl like a better query that will cover more hosts like
pprdefghk01 or pprdabcask04 or pprderedbl01 or pprdrrsasl04 etc .....

[martin_mueller]

The easy option would be to cover all hosts, and remove the host= filter.

If you only want to view a set of hosts I'd recommend storing that set in a lookup file, and either filtering by an automatic lookup output field or using a subsearch like index=log [inputlookup that_lookup | fields host] ....