I have a saved search that will take a 'host' parameter, like the following: |savedsearch "searchName" host="hostName" This works when I only want to search for one host, but I'm running into an issue where if I want to specify multiple hosts, this format will not work. I cannot do something like the following because it will only take the last available valid host (hostName2 is the one that shows up in the search results.): |savedsearch "searchName" host="hostName1" OR host="hostName2" I know that is is possible to use a wildcard (host="hostName*" will return all hosts in this format), but I only want the two specific hosts. Do you have any suggestions on how to include two different specific hosts in this situation? This is with Splunk version 5.0.4 ... View more

In the documentation here, it says that the the data will update every ten minutes once an accelerated report summary is initially created and completed. When handling many searches, I can see this potentially being a problem if all searches are run at the same time. Is it possible to edit the frequency at which the data gets updated, or even better, to randomize that frequency so that there is smoother CPU usage than large spikes every ten minutes? I am unsure if this is actually the case, but I want to make sure that if I put this in a high stress environment, there will not be potentially crippling CPU spikes when it could possibly be prevented. If you are currently using report acceleration, have you noticed the CPU usage because of it? ... View more

I'm currently trying to optimize my searches to keep my Splunk searches as quick as possible. Is there any appreciable difference in search time or efficiency in the two following searches? My main point is, does condensed logic help make searches faster, or does it not matter in these cases? index=* NOT a NOT b NOT c index=* NOT (a OR b OR c) Both of these are logically equivalent because of the implied ANDs in the first query ((NOT a) AND (NOT b) AND (NOT c)), so I was curious if there was any major timing difference in the two queries. ... View more