Replace values in query

[leandromatperei]

Guys.

I have the following query below that shows the results by hosts, it works very well. However, I need to replace the host with another value, example below

index=text (host=host1 OR host=host2 OR host=host3 OR host=host4)) 
 timechart span=1h count by host

host1 = Valuea
host2 = Valueb
host3 = Valuec
host4= Valued

What is the best way to make this replacement using eval or a lookup?

Att.

[manjunathmeti]

hi @leandromatperei,
You can use eval command with case function.

| eval host=case(host="host1", "Valuea", host="host1", "Valueb", host="host1","Valuec", host="host1", "Valued") 

If this reply helps you, an upvote/like would be appreciated.