My existing search string is:
index="os" OR index="app" host=ip-10-12-70-56.va2.b2c.nike.com sourcetype=ps| multikv fields ARGS filter java| rex "Db2cid\=(?<b2cid>job-\\w+..)_" | dedup b2cid,host | chart count by b2cid,host | eval b2cidlowr=lower(b2cid) | sort b2cidlowr | fields - b2cidlowr
This search is returning hosts like the following:
job-AsyncReqAgentServer-0
job-CloseOrderAgentServer-0
job-CreateOrderJMSServer-0
job-CreateShipmentInvoiceJMSServer-0
job-FraudResponseJMSServer-0
But I have another couple of host which ideally should have reflected but not reflecting.
If I declare all the possible hosts in the search, can it return the hosts that are not getting rendered?
How to write such a search string?
... View more