Hello , Im trying to run a audit search for high priority linux servers - should have the following in the search sudo login, failed login, login/logoff and account change and deletion. i was able to combine to searches with the "OR" command: index="ssh_login_index" sourcetype="linux_secure" (process=sshd session opened OR closed) host="linux server" but still cant combine the rest of the searches to the search above. Thanks in advance! ... View more