Specify More Than One Host?

[eboniebutler]

Hey everyone! I have a pretty simple question. Below is a sample search string:

index=os sourcetype=df mount="/etc" host=server1

Is there a way to specific more than one host? I thought I could get away with host=server1,server2 but it didn't work out. I'm trying to tailer my visualization chart for my clients as much as possible so it would help out to just display the data that actually matters to them.

[plantiw]

so I am doing sourcetype cisco:asa and host=* but I am not getting all the hosts. Also how do I just get a report on hosts without all the log info?

[thambisetty]

you can do like below,

index=os sourcetype=df mount="/etc" host IN (server1,server2)

[reswob4]

Depends on how many hosts you want to specify. If it's two or three, simply using OR will do it:

index=os sourcetype=df mount="/etc" (host=server1 OR host=server2 OR host=server3)

If you get into too many hosts, then you may be able to sue a wildcard if they have similar names. If not, then you may have to use more esoteric means, like a lookup table.