Hey everyone! I have a pretty simple question. Below is a sample search string:
index=os sourcetype=df mount="/etc" host=server1
Is there a way to specific more than one host? I thought I could get away with
host=server1,server2 but it didn't work out. I'm trying to tailer my visualization chart for my clients as much as possible so it would help out to just display the data that actually matters to them.
Depends on how many hosts you want to specify. If it's two or three, simply using OR will do it:
index=os sourcetype=df mount="/etc" (host=server1 OR host=server2 OR host=server3)
If you get into too many hosts, then you may be able to sue a wildcard if they have similar names. If not, then you may have to use more esoteric means, like a lookup table.