How do list multiple sources in a query: sourcetype=xml source="/wealthsuite/tti/current/*"?
Ok, a few things to try:
- Try removing quotes
- Try escaping the path with and wihtout quotes \/wealthsuite\/tti\/current\/*
sourcetype=bar OR sourcetype =foo OR sourcetype=cisco:*
it's not the sourcetype that is the issue it is that the sources are xml files at a linux location and the search isn't allowing a wildcard.
