So I am creating a query with the intent of finding events from 2
different machines. My test query looks like this:

(pn:"CollectorNodeName") AND (shn:"server1") OR (shn:"server2")

This is only returning events from server1 and nothing from server2,
even though I have confirmed events from server2. What am I missing?

psmcgovern's Profile:
View this thread: