Best option is to use the wildcard to get you filter done, as specified by @Ayn and @richgalloway. The regex options may be inefficient based on your data distribution among the source and filter, however, another option that you can try is to specify the required source name in the base search, using subsearch, something like this index=blah [| metadata type=sources index=blah | table source | regex source="a[1-3].gz" ] | rest of the search The subsearch will grab all the required source (a1.gz/a2.gz/a3.gz in your example) and generate an OR condition into the base search, so effectively your search will become:- index=blah ((source=a1.gz) OR (source=a2.gz) OR (source=a3.gz)) | rest of the search ... View more

you could build a form with that basic root search and create three different panels charts subsearches or a saved search. Since 'chart' represents on container and panel, I think you'd need to specific a search for it.. http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML But since you're working in XML, it's relatively easy to just copy and modify the same container.. ... View more

@mdmaala Below link will help you. https://github.com/packetiq/SplunkArchitect/blob/master/Creating-and-Using-Summary-Indexes.md ... View more

Try: search | fillnull value=null | stats count by id, src, lr fillnull will fill empty values even when the field does not exist. ... View more