You can do this with a change block in the input object that sets a new token to the label, like: <change> <set token="dropdown_label">$label$</set> </change> See the following link for more details: https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Viz/tokens#Access_labels_and_values_of_form_inputs ... View more

@montgomeryam I could not figure this out on the splunk side. But if you contact your windows admin, there is place where you can uncheck check-boxes to exclude cs-cookie and other fields from logging. So there is no data for splunk to pick up. ... View more