by filter i type host="server1"
can I edit this
error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )
to
error OR failed OR severe OR ( host="server1" )
If so how can I add more servers?
With | ?
Example host="server1" | "server2" | "server3"?
or addinfo?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands
Excuse me, this is my first Splunk server 😉
... View more