Is there a way I could combine the results from the above query with the first query to refine the search command?

[_pravin]

Hi Community,

I have the below search query

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| search h = hp742srv OR dell970srv OR dell428srv OR hp548srv OR dell429srv OR dell477srv OR dell433srv 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=30 

I am trying to refine the search query where I had to manually enter the host names using the OR condition. I am trying to figure out if there is a way I could use an alternative way to get the same result from the above search.

The below search gives all the names used in the search command above.

index=m_logs "mx.env"="hp742srv.scz.m.com:24000" 
| table host 
| dedup host

 Is there a way I could combine the results from the above query with the first query to refine the search command?

Thanks in advance.

Regards,

Pravin

[ITWhisperer]

index=_internal 
    [ search index=m_logs "mx.env"="hp742srv.scz.m.com:24000" 
| table host 
| dedup host
| format ]
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=30 

[_pravin]

Hi @ITWhisperer ,

Thanks for the response.

The main objective was to remove the below line in the query

| search h = hp742srv OR dell970srv OR dell428srv OR hp548srv OR dell429srv OR dell477srv OR dell433srv 

 I tried a query similar to your query earlier but couldn't get the desired results as the original query.

Is there some other query technique I can use?

Regards,

Pravin

[ITWhisperer]

index=_internal 
    h IN (hp742srv, dell970srv, dell428srv, hp548srv, dell429srv, dell477srv, dell433srv)
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=30 

[_pravin]

Hi @ITWhisperer ,

Thanks for the SPL but this actually changes the entire query results.

Doesn't work as intended.

Regards,

Pravin