How to create multiple values in time chart based on dropdown menu token?

[jialiu907]

I am looking to have a time chart table that has a dropdown menu based on a token,  be able to show all of the values of the dropdown menu in its first option and have it displayed as the default. Each value only shows one line, and I'm looking for all of the lines to populate the chart in the All selection.

This is my current time chart.

This is the current values based on the token. 

This is the current search.

index=main host=$token$* sourcetype=syslog process=elcsend "\"config " CentOS 
| rex "([^!]*!){2}(?P<type>[^!]*)!([^!]*!){4}(?P<role>[^!]*)!([^!]*!){23}(?P<vers>[^!]*)"  
| search role=std-dhcp
| eval location=$token|s$
| timechart span=1d count by location

If unable to do that, I am also open to the option of removing the dropdown menu and only having the default time chart showcasing all of the values.

[ITWhisperer · Accepted solution]

If location is always the first 4 characters of host, then use this

| eval location=substr(host,0,4)

[jialiu907]

Thank you so much, that worked perfectly!