Is there a way to format this search so I don't need to use ComputerName= repeatedly? I feel like I'm doing it the hard way.
index=av_log sourcetype=sophos_threat_events AND (ComputerName=AMS* OR ComputerName=CDS* OR ComputerName=CHI* OR ComputerName=ECS* OR ComputerName=ESL* OR ComputerName=FPT* OR ComputerName=LWC* OR ComputerName=MPS* OR ComputerName=SPO*) | dedup ComputerName FullFilePath | timechart count by sum(FullFilePath)
Although I bet that works, its not any more simplified than what I created above.
Update: Option 2 looks like it would be a good option. Especially since this location list can constantly change but be used in multiple searches.
You can add extra fields in the lookup file so exclude ComputerNames based on the places they are being used.
Try this
Options 1:
index=av_log sourcetype=sophos_threat_events [|stats count | eval ComputerName="AMS*,CDS*,CHI*,ECS*,ESL*,FPT*,LWC*,MPS*,SPO*" | makemv ComputerName delim="," | mvexpand ComputerName | fields - count | format] | dedup ComputerName FullFilePath | timechart count by sum(FullFilePath)
Option 2
Create a lookup table file with field name as ComputerName and values like AMS*, CDS* etc.
ComputerName.csv
ComputerName
----------
AMS*
CDS*
CHI*
ECS*
ESL*
FPT*
LWC*
MPS*
SPO*
Once this is setup, you query will be like this
index=av_log sourcetype=sophos_threat_events [|inputlookup ComputerName.csv | format]| dedup ComputerName FullFilePath | timechart count by sum(FullFilePath)
I've used Option 2 with success.
You can always go for option 2 which is more scalable and easier to maintain.