people often don't like it to use "index=...". I've tried to make logs easy accessable for them by using macros instead.
But now people wan't to have a more easier way, without ``. Is there a way to just use a single word for choosing an index in the background? For example just the word "firewall" ?
With tags and eventtypes it is the same. You have to use "tag=...".
Thank you in advance
Create you own
flashtimeline and include the indexes as a dropdown...
This would allow to have a free text box for the search string, and then have a dropdown that includes a list of indexes that users can search on.
Perhaps a bit "radical" but hey-ho...
Good starting points:
Just an idea, but hope it helps.
Nope, there is no easier way. I would argue that the ``
are pretty easy anyway. Any word entered without these characters would just be interpreted as a search term or command.
Oh, there is the other option of adding it to the indexes their role search by default? It depends on the use case and their roles really. But it is another option if they really are concerned about typing in an additional 2 characters 😉
create a button which adds for a existing search a kind of suffix.
normal search : index= abc
click to button : index = abc OR index = cde
all stuff after index = abc comes from the button.