Hello
I have to search events on many sourcetype with name begin by "ezop:web"
So I use a wildcard after "ezop:web*"
index="tutu" sourcetype=ezop:web*
Is it the good practice or is it better to do somethin like this :
(sourcetype=ezop:web1 OR sourcetype=ezop:web2 OR sourcetype=ezop:web3)
Or pearhaps something else?
Thanks
Hi
In personally I use the 1st one in most cases. To be sure which one is best for your particular cases I propose you to check with Job Inspector the costs of different versions. This could be different based on cardinality of sourcetypes and amount of your events you have.
Of course if you have ST likes ezop:web1 .... ezop:web9999 then it's better to use 2nd one or sourcetype IN (ezop:web1, ezop:web2, ezop:web3). But as I said, you should use Job Inspector to check which one is best in which case.
r. Ismo
Hi
In personally I use the 1st one in most cases. To be sure which one is best for your particular cases I propose you to check with Job Inspector the costs of different versions. This could be different based on cardinality of sourcetypes and amount of your events you have.
Of course if you have ST likes ezop:web1 .... ezop:web9999 then it's better to use 2nd one or sourcetype IN (ezop:web1, ezop:web2, ezop:web3). But as I said, you should use Job Inspector to check which one is best in which case.
r. Ismo