Better way to write OR statements against fields

[hlarimer]

Is there a way to format this search so I don't need to use ComputerName= repeatedly? I feel like I'm doing it the hard way.

index=av_log sourcetype=sophos_threat_events AND (ComputerName=AMS* OR ComputerName=CDS* OR ComputerName=CHI* OR ComputerName=ECS* OR ComputerName=ESL* OR ComputerName=FPT* OR ComputerName=LWC* OR ComputerName=MPS* OR ComputerName=SPO*) | dedup ComputerName FullFilePath | timechart count by sum(FullFilePath)

[hlarimer]

Although I bet that works, its not any more simplified than what I created above.

Update: Option 2 looks like it would be a good option. Especially since this location list can constantly change but be used in multiple searches.

[somesoni2]

You can add extra fields in the lookup file so exclude ComputerNames based on the places they are being used.

[somesoni2]

Try this

Options 1:

index=av_log sourcetype=sophos_threat_events [|stats count | eval ComputerName="AMS*,CDS*,CHI*,ECS*,ESL*,FPT*,LWC*,MPS*,SPO*" | makemv ComputerName delim="," | mvexpand ComputerName | fields - count | format] | dedup ComputerName FullFilePath | timechart count by sum(FullFilePath)

Option 2

Create a lookup table file with field name as ComputerName and values like AMS*, CDS* etc.

ComputerName.csv
ComputerName
----------
AMS*
CDS*
CHI*
ECS*
ESL*
FPT*
LWC*
MPS*
SPO*

Once this is setup, you query will be like this

index=av_log sourcetype=sophos_threat_events [|inputlookup ComputerName.csv | format]| dedup ComputerName FullFilePath | timechart count by sum(FullFilePath)

[richgalloway]

I've used Option 2 with success.

[somesoni2]

You can always go for option 2 which is more scalable and easier to maintain.