Multiple sourcetypes in a search?

[PHRaymond]

Just curious, can this search parameter be streamlined at all?

sourcetype=typeone OR sourcetype=typetwo OR sourcetype=typethree OR sourcetype=typefour

I'm just looking for something more elegant, so this isn't critical by any means. I was hoping for something like:

sourcetype=(typeone,typetwo,typethree,typefour)

but no love. Any thoughts?

Thank you.

[mux]

You can also use tags on the sourcetypes.

tag=yourtagname yousearchhere

and it will search all the sourcetypes with that tag name.

[dwaddle · Accepted solution]

There isn't anything directly like that in the search language. For a small set of sourcetypes (or any other field), an OR between each is the best approach. You can encapsulate this inside of a macro to make for less typing.

For a larger set (large enough to be willing to maintain a lookup table), you can emulate this using inputlookup and a subsearch. For example, define a lookup table in $SPLUNK_HOME/etc/system/lookups called many_sourcetypes.csv as follows:

sourcetype
typeone
typetwo
typethree
.
.
.
typefiftyseven

Then, in your search --

[ | inputlookup many_sourcetypes.csv | fields sourcetype ] ...

[PHRaymond]

That's pretty much what I figured. Thank you!