Search a two messages from 6 hosts and show top 6 results

[sandeepparcha44]

Hi

I am trying to search two strings in message like "Stopped successfully" and "connected" from 6 host names.

Please help me

am writing like below

Source="WinEventlog:applicaiton"

|rex "message\s(?<message>.*).*"

|search host like "host1" OR host Like "host2"

| search message="stopped succesfully" OR "Connected"

|table _time, host, message

[kamlesh_vaghela]

@sandeepparcha44 

Can you please try this?

Source="WinEventlog:applicaiton" (host="host1*" OR host="host2*") (message="*stopped succesfully*" OR message="*Connected*")
| rex field=_raw "Message=(?<message1>.*).*"
|table _time, host, message, message1

[sandeepparcha44]

it worked , but i have to add

"Message=Event*(?<message1>.*).*

Thank you..

[sandeepparcha44]

Still same,

sample message in the log will be like below

Message=Event : _*protocol* Name  : tcp://servername:port

[sandeepparcha44]

Still same,

sample message in the log willbe like below

Message=Event : _*protocol* Name  : tcp://servername:port

[bowesmana]

Are you spelling application wrong

WinEventlog:applicaiton

should be 

WinEventlog:application

[sandeepparcha44]

it updated and resoled

[sandeepparcha44]

Thank you Kamalesh, its working for Hosts.

but am not getting "message"

[kamlesh_vaghela]

@sandeepparcha44 

I have updated my answer. Can you please try it?

[kamlesh_vaghela]

@sandeepparcha44 

Try like this,

Source="WinEventlog:applicaiton" (host="host1*" OR host="host2*") (message="*stopped succesfully*" OR message="*Connected*")
| rex field=_raw "message\s(?<message1>.*).*" 
|table _time, host, message, message1

KV