I have the following query below that shows the results by hosts, it works very well. However, I need to replace the host with another value, example below
index=text (host=host1 OR host=host2 OR host=host3 OR host=host4))
timechart span=1h count by host
host1 = Valuea
host2 = Valueb
host3 = Valuec
What is the best way to make this replacement using eval or a lookup?
hi @leandromatperei,You can use eval command with case function.
| eval host=case(host="host1", "Valuea", host="host1", "Valueb", host="host1","Valuec", host="host1", "Valued")
If this reply helps you, an upvote/like would be appreciated.