Query multiple streams
The DNIF Query Language lets you query multiple streams separated by a comma.
Syntax
The syntax for querying multiple streams is as follows:
stream = stream_name1,stream_name2, stream_name3
Here,
The keyword stream is a standard DQL keyword used to retrieve data
stream_name1, stream_name2, and stream_name3 are the names of the streams from which the data will be retrieved. These stream names are separated by commas. Let’s now look at a practical example
stream = AUTHENTICATION, FIREWALL,THREAT
The above DQL query retrieves all fields for each event in the FIREWALL, AUTHENTICATION, and THREAT streams.