How to write a simple search query to add another set of host name along with the current present host name?

[Hemnaath]

Hi All, I have used the below query to capture the splunk service status (Up or Down) via splunkd.log. This query is working fine, but we have added few more splunk instance to the current environment and we need to capture these splunk service status along with the old splunk instances. My requirement is to include the newly build splunk host details to pull their service status.

Newly build host starts with the letter vms , so how to add this host name along with host name hs

Query details :
index=_internal host=hs* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures

thanks in advance.

[inventsekar · Accepted solution]

Hi Hemnaath, Please check -

index=_internal host=hs* OR host=vms* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures

[pragi_eashwar]

Hi Hemanth

If the query is same just use the OR operator for the host like mentioned below,

index=------ host=hs* OR host=vms* -----query--------

[Hemnaath]

thanks it worked, at same time could please tell me where we need to use OR operator and AND operator appropriately in SPL query. thanks in advance.