Another solution is to put your 150 hosts into a lookup, and then use it in a subsearch:
<some search terms> [ inputlookup myHosts | fields host ]
The end result will be
<some search terms> host=host1 OR host=host2 OR host=host3 OR host=host4 ...
Ordinarily gratuitous and/or strange use of subsearches is to be avoided, but if the number of hosts really is quite small this can be a very useful trick. For one thing you can have a script regenerate the csv periodically. Or you can have another splunk search running on a schedule that regenerates the lookup using the outputlookup command.
Or you can have a splunk search that reads in the existing lookup, appends new rows to them, dedupes them, and then writes it out to the lookup. Often summary indexing is a better idea overall but still, there are neat tricks here.
Also although subsearches are never you actually end up with a pretty efficient search here. It may be slightly more efficient than using tags even, im not sure.
... View more