Add multiple device types to search string

[fschiavo]

I want to add cer device type to the following string to search for both. Boolean expression?

index=cisco cdnt* partial service

[somesoni2]

By default all filters (separated by space here) are using AND boolean expression. you can just add your devicetype string (if its not an extracted field) OR devicetype="valuehere" (if its an extracted field).

[kristian_kolb]

Yes, with implicit AND between all search terms. Examples;

host=alice host=bob

will return no events. host cannot be both 'alice' and 'bob' at the same time.

(host=alice user=david) OR user=cecilia

will return all events from host 'alice' where user=david, and all events where user=cecilia, regardless of originiating host.

host=sales price!=55

will return all events from the host 'sales', if the events contain the field 'price' and the value is not '55'.

host=sales NOT price=55

will return all events from the host 'sales', that don't contain price=55, even events that do not have 'price' in them at all.

and so on. See more in the docs.

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchTutorial/Aboutthesearchapp

/K