It is possible to use a variable under mstats search?

[soulmaker]

Hi there, 

I am trying to make a statistic graph in my dashboard using the search below.  

| mstats rate(vault.runtime.total_gc_pause_ns.value) as gc_pause WHERE `vault_telemetry` AND cluster=* AND (host=*) BY host span=5m
| timechart max(gc_pause) AS iowait bins=1000 BY host
| eval warning=3.3e7, critical=8.3e7

**Note that the search below comes from the pre-defined dashboard template but it is not working as is in my environment. 

In my Splunk, when I do a mpreview of my index `vault_telemetry` I am getting a result like the below:

metric_name:vault.hostname1.runtime.total_gc_pause_ns
metric_name:vault.hostname2.runtime.total_gc_pause_ns
metric_name:vault.hostname3.runtime.total_gc_pause_ns
metric_name:vault.hostname3.runtime.total_gc_pause_ns
metric_name:vault.hostname4.runtime.total_gc_pause_ns

If I modify the pre-defined search from the template using the below I can get the result however, I can only do it on one hostname. 

| mstats rate(vault.hostname1.runtime.total_gc_pause_ns) as gc_pause WHERE `vault_telemetry` span=5m
| timechart max(gc_pause) AS iowait bins=1000
| eval warning=3.3e7, critical=8.3e7

I would like to have all the hostname shows on my single panel. Can someone please able to assist and help me with the correct search index I need to use?

[bowesmana · Accepted solution]

If I understood correctly, just use wildcards

| mstats rate(vault.hostname*.runtime.total_gc_pause_ns) as gc_pause_* WHERE `vault_telemetry` span=5m
| timechart max(gc_pause_*) AS iowait_* bins=1000
| eval warning=3.3e7, critical=8.3e7

[soulmaker]

Your a real legend @bowesmana . I didn't realize that you can put wildcards in the middle. Thank you so much for your help. I am new to Splunk so your help is really helpful.