No worries - speaking with the sales engineer who explained that one
host value was indexed at index time and another one was discovered at search time. Apparently, only the index time value is searchable when searching against the
H can achieve with OR ,IN
host=aaa or host=bbb
host in ("aaa","bbb")
If my answer helped please accept answer or up vote
If that search does not work, then your
host field does really have both values. We will never get to the bottom of this unless you post an event. and your props.conf settings.