~host

The ~host alias references all keywords for a hostname. You can search for the complete hostname or a portion of a fully qualified hostname. ~host references such fields as:

`rawmsghostname`	Hostname, when available, of the host sending the raw message. In some cases, this may be a log relay or forwarder
`targethost`	Typically observed in IDS/IPS, AV, and other logs when referencing a targeted system or user
`hostname`	Hostname which is used whenever the source or destination is unclear or unknown
`srchost`	Hostname of the source machine when direction is known and/or relevant which typically resolve to `srcip` or `srcipv6`
`dsthost`	Hostname of the destination machine when direction is known and/or relevant that typically resolves to `dstip` or `desipv6`
`server`	Hostname for when `srchost`or `dsthost` do not apply such as a central management server, proxy, or router serving a nondirectional role
`node`	Hostname for specific references to a node that is typically a sensor node
`agent`	Name of an agent
`sensor`	Name of a sensor
`workstation`	Name of workstation that is used only when hostname is already used and workstation is explicitly declared

For example:

~host=corp-12345

~host:subdomain

~host=mycompany.com

~host:copr-12345.subdomain.mycompany.com