You can do this with a change block in the input object that sets a new token to the label, like: <change> <set token="dropdown_label">$label$</set> </change> See the following link for more details: https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Viz/tokens#Access_labels_and_values_of_form_inputs ... View more

Expanding on @amrit's example code, I was able to build a filter to exclude some HTTP Status codes from IIS logs using: props.conf [iis] TRANSFORMS-HttpErrorsOnly=HttpErrorsOnly transforms.conf [HttpErrorsOnly] SOURCE_KEY=field:sc_status REGEX=[123]\d+ DEST_KEY=queue FORMAT=nullQueue ... View more