And the keywords I want to look for are—from the Cisco side: “severe” and “error”
From the VMware side: “MCE” and “MCA”
One of the issues I am running into is that both sourcetypes have a host field, so I’d want to strip out from which sourcetype each ‘host’ field comes. (For VMware, we have 11 ESXi hosts that populate that field, and only one Cisco host.)
My end goal would be a line or area chart that shows counts over time one of the sourcetype+associated keywords overlaid with the other one.