https://community.splunk.com/t5/Splunk-Enterprise/Replace-values-in-query/m-p/538627#M4874 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/216287">@leandromatperei</a>,<BR />You can use <STRONG>eval</STRONG> command with <STRONG>case</STRONG> function.</P><LI-CODE lang="markup">| eval host=case(host="host1", "Valuea", host="host1", "Valueb", host="host1","Valuec", host="host1", "Valued") </LI-CODE><P>&nbsp;</P><P>If this reply helps you, an upvote/like would be appreciated.</P> Thu, 04 Feb 2021 14:50:50 GMT manjunathmeti 2021-02-04T14:50:50Z https://community.splunk.com/t5/Splunk-Enterprise/Replace-values-in-query/m-p/538619#M4873 <P>Guys.</P><P>I have the following query below that shows the results by hosts, it works very well. However, I need to replace the host with another value, example below</P><P>&nbsp;</P><LI-CODE lang="markup">index=text (host=host1 OR host=host2 OR host=host3 OR host=host4)) timechart span=1h count by host</LI-CODE><LI-CODE lang="markup">host1 = Valuea host2 = Valueb host3 = Valuec host4= Valued</LI-CODE><P>&nbsp;</P><P>What is the best way to make this replacement using eval or a lookup?</P><P>Att.</P> Thu, 04 Feb 2021 14:16:30 GMT https://community.splunk.com/t5/Splunk-Enterprise/Replace-values-in-query/m-p/538619#M4873 leandromatperei 2021-02-04T14:16:30Z https://community.splunk.com/t5/Splunk-Enterprise/Replace-values-in-query/m-p/538627#M4874 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/216287">@leandromatperei</a>,<BR />You can use <STRONG>eval</STRONG> command with <STRONG>case</STRONG> function.</P><LI-CODE lang="markup">| eval host=case(host="host1", "Valuea", host="host1", "Valueb", host="host1","Valuec", host="host1", "Valued") </LI-CODE><P>&nbsp;</P><P>If this reply helps you, an upvote/like would be appreciated.</P> Thu, 04 Feb 2021 14:50:50 GMT https://community.splunk.com/t5/Splunk-Enterprise/Replace-values-in-query/m-p/538627#M4874 manjunathmeti 2021-02-04T14:50:50Z