lnteractive analysis filter by "hostname contains"

[ikiris]

I noticed that if you use the 'hostname contains' filter and then only part of the hostname 'server' (say full hostname is serverA.zone.mycompany.net), it will not find any hosts.

It looks like hostname is parsing the FQDN into parts (serverA, zone, mycompany, net) and then applying the contains filter to each of those instead in it's entirety instead of doing adding a wildcard like server*. If I do server* as my filter parameter, it works fine.

I just wanted to check if this is expected behavior. I validated this in 2.5TP2 and 2.0GA.

[sflanders · Accepted solution]

All queries in LI are full keyword queries where a keyword is defined as any alphanumeric, hyphen, and/or underscore character. As such, serverA is a keyword, but server is not. If you cannot construct a query with a complete keyword then you should either change the operator from contains to starts with or use globs (e.g. server*). For more information, see my query building series here: http://sflanders.net/?s=query+building+in+log+insight&submit=Go

[sflanders]

If your question is answered can you mark it as answered?