I have 20 host names and I want to use tags.
I've been doing my searches host=X OR host=Y OR host=Z, but I want to use tags instead since it is much easier on the eyes in a search string.
Let's say I create a tag called xyz with host=X, host=Y, host=Z.
To search on this, I am trying to use "tag=xyz | stats count by host" but I am getting no results. I have also tried searching "tag::host=xyz | stats count by host" and I am still getting no results.
What am I doing wrong here?
The simplest thing to do is to create an
eventtype There will be a field called
Search string where you paste your search and a field called
Tag(s) where you paste your tag name. Done!