Hi
I want to search several host include in indexes. last 24hour
index name is a_1, a_2, a_3....
how to search?
thank you
what is the result you want to achieve?
because if you want number of events per index & host it will be something like this:
index="a_*" | stats count by index,host
Host volume in index