I want to add cer device type to the following string to search for both. Boolean expression?
index=cisco cdnt* partial service
Yes, with implicit AND between all search terms. Examples;
will return no events. host cannot be both 'alice' and 'bob' at the same time.
(host=alice user=david) OR user=cecilia
will return all events from host 'alice' where user=david, and all events where user=cecilia, regardless of originiating host.
will return all events from the host 'sales', if the events contain the field 'price' and the value is not '55'.
host=sales NOT price=55
will return all events from the host 'sales', that don't contain price=55, even events that do not have 'price' in them at all.
and so on. See more in the docs.
By default all filters (separated by space here) are using AND boolean expression. you can just add your devicetype string (if its not an extracted field) OR devicetype="valuehere" (if its an extracted field).