searching on multiple items

[jalfrey]

I have two searches that are very similar and I want to combine the results.

index=sonicwall new_category="Security Services" | stats count(host) by msg host | rename msg as "Warning Message" | rename count(host) as "Total Warnings"

index=sonicwall new_category="Firewall Hardware" | stats count(host) by msg host | rename msg as "Warning Message" | rename count(host) as "Total Warnings"

Seems like I should be able to do something like
index=sonicwall new_category="Firewall Hardware" or new_category="Security Services" but that returns nothing.

[asimagu · Accepted solution]

try uppercase OR 😉

[jalfrey]

well that was simple. 🙂