Hi,
I also advice you to use a subsearch to filter the main query. this will look at this:
... [search index=name_of_your_index |stats count(error) by host]
Replace the ... by your main search
Hi,
I also advice you to use a subsearch to filter the main query. this will look at this:
... [search index=name_of_your_index |stats count(error) by host]
Replace the ... by your main search
Hello
You can use a subsearch to filter the main query, leike this:
YourBaseSearchToFilterErrors [search YourIntersectSearchThatReturnsAListOfHosts] | any other commands
This will transalate into something like:
index=main "error" host=1 OR host=2 OR host=3 | other commands
Regards