Best method for multiple inputs for a search

[a212830]

Hi,

I have a search that is going to require a fair amount of inputs (4 hosts, and 5 or 6 filesystems per host) to monitor disk space. What is the best practice for doing a search like this? I don't want to hard-code it. Could it take an input as a lookup? If so, how would I pass two variables into the search?

TIA...

[woodcock]

I assume the reason you are not interested in hardcoding it is because the search is going to be part of a large number of other searches or dashboards and hardcoding something that is replicated in a large number of other places means maintenance on it when it changes is very cumbersome. If this is the case, you should create an eventtype using the search and then reference the eventtype in your dashboards and other searches. Then, when you have to change your base search, you just change it in the eventtype and instantly all the other searches are updated at the same time. For example, you might have a large number of hosts that you need to discriminate as "Customer X" you can do this:

In eventtypes.conf

[CUSTOMER_X]
search = index="myIndex" sourcetype=mySourcetype host=A OR host=B OR host=C OR host=D

Then in your searches:

eventtype=CUSTOMER_X