i am seeking a way to define a variable where i can define a static list of hosts to (re-)use in adhoc searches Example instead of doing this everytime           index=os host=hosta OR host=hostb OR host=hostc ....host=hostnn Instead do something like this            index=os host=$MY_HOSTLIST_VAR I've been trying to do something with Lookup csv file which I uploaded, but can't seem to get that syntax correct. ... View more

Adhoc search of bash_history files and attempting to just pull out listing of commands regardless of the timestamp value. I am not interested at this point in retrieving the Timestamp. Here is what a given search returns: Event 1 #1597921243 <-- Timestamp whoami                               <-- Command whoami is returned as part of Event 1 Event 2 uname                 <-- Command uname is returned as a unique Event Event 3 #1597921243 <-- Timestamp returned as unique event Event 4 df -h                      <-- Command df -h is returned as a unique Event Event 5 #1597678043 <-- Timestamp returned as unique event When I execute this Search only Event 1 is returned which is Timestamp and separate line with whoami command index=os sourcetype=bash_history host=my_host_name |regex "^#\d+\s+(?P<PGCMD>\w+)" When I execute this Search 3 Events are returned, Event 1 (TS + whoami) and Event 2 (uname) and Event 4 (df) index=os sourcetype=bash_history host=my_host_name |regex "[a-zA-Z]+" When I execute this Search 2 Events are returned, Event 2 (uname) and Event 4 (df) index=os sourcetype=bash_history host=ps2pr608661 |regex "^\w+" What I am trying to end up with is just viewing the commands, no time stamps, in essence results should just be whoami, uname and df -h nothing else I've been searching for a solution but 1.5 days into this I cannot find one. Any help is appreciated ... View more