Getting Data In
Highlighted

How can I search for the field host with multiple values?

Ultra Champion

We ended up with an operation index that has two hosts per event, let's say aaa and bbb.
Searching for index=shortland host=aaa brings results but index=shortland host=bbb does not.

What can it be?

Tags (3)
0 Karma
Highlighted

Re: How can I search for the field host with multiple values?

SplunkTrust
SplunkTrust

Can you share a sample (sanitized) event, please?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How can I search for the field host with multiple values?

Ultra Champion

No worries - speaking with the sales engineer who explained that one host value was indexed at index time and another one was discovered at search time. Apparently, only the index time value is searchable when searching against the host field.

0 Karma
Highlighted

Re: How can I search for the field host with multiple values?

Ultra Champion
0 Karma
Highlighted

Re: How can I search for the field host with multiple values?

Hi @ddrillic

H can achieve with OR ,IN
EG:- host=aaa or host=bbb

host in ("aaa","bbb")

If my answer helped please accept answer or up vote

Highlighted

Re: How can I search for the field host with multiple values?

Ultra Champion

Thank you @harishalipaka.

0 Karma
Highlighted

Re: How can I search for the field host with multiple values?

Esteemed Legend

If that search does not work, then your host field does really have both values. We will never get to the bottom of this unless you post an event. and your props.conf settings.

0 Karma