You can use the populating search of the drop down to add dynamic options and do something like this to categorise the host type index=aaa source="/var/log/test1.log"
|stats count by host
| eval ca...
See more...
You can use the populating search of the drop down to add dynamic options and do something like this to categorise the host type index=aaa source="/var/log/test1.log"
|stats count by host
| eval category=case(match(host, "t"), "Test",
match(host, "q"), "QA",
match(host, "p"), "Prod",
true(), "Unknown") change the match statement regex as needed and the category you want to show. category will be the <fieldForLabel> and then you need to make the <fieldForValue> to contain the value element you want for the token.