saved search multiple values

[klaudiac]

Hi guys, 

I'm trying to create a saved search (instead of  typing the same search command few times a day) , but there's a small "catch" in my search - I want to put multiple choice as one of the variables. 

e.g. Long search: 

index=console1(sourcetype=c1:agent OR sourcetype="c1:agent_registered") computerName="computer1 OR computer2 OR computer25 
| stats count by host

I created a basic saved seach: index=console1(sourcetype=c1:agent OR sourcetype="c1:agent_registered") $computerName$
| stats count by host 

So my computerName can be different every time i need to check a new machine., but I can only one at a time... Is there a way to add that option to my saved search?

[richgalloway]

Have you considered putting the search into a dashboard?  Then you can have an input selector where you can choose the computers to include in the search.

[Nisha18789]

Hello @klaudiac , do you have the host list with you? Also, is it like a partcular time only a particular host needs to be searched? If so, does this change with time - ie, at 6 PM today Host XXX needs to be checked while at 6PM tomorrow Host YYY needs to be checked?

If its just simple search from a list of host which you have to begin with you can use :

index=console1(sourcetype=c1:agent OR sourcetype="c1:agent_registered") host IN (hostname1,hostname2..)
| stats count by host 

[klaudiac]

Hey, 

The list of the hosts depends on a day when we do the installations, so one day it can be 1 host, and another day I can have a list of 13 to check. 

There's no set time frame so whenever I log in the morning I just set my time to last 30min or last 60min and run it then and see if they are active.