How to run same search for different source files?

[deepthi5]

Hi Team,

Again an urgent requirement. I have got a couple csv files with source name c:\\budapest.csv, c:\\singapore.csv, c:\\germany.csv etc

All I wantt is some stats sorted with country and run the same search on all other files.

Right now I have a searcj where I am appending each and every source file with the same search which is becoming bigger as I add more subsearches:

source="C:\\Budapest Router1full.csv" host="SEZ00VVM-153"   sourcetype="csv" date_wday!=saturday AND date_wday!=sunday|  rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename |where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=IN/1048576 |bin _time span=1mon| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time   |eval total=Percentile/maxin*100|timechart span=1d values(total)   As Budapest(total%)|append[search source="C:\\Adelaide full.csv" date_wday!=saturday AND date_wday!=sunday|  rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename |where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=IN/1048576 |bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time   |eval total=Percentile/maxin*100|timechart span=1d values(total)   As Adelaide(total%)]

Please help

Thanks ,
Deepthi

[HeinzWaescher · Accepted solution]

To use same query for different sources:

 source=budapest.csv OR source=singapore.csv OR source=germany.csv | *your search...*