If you have text fields for both t_host and t_pod in your dashboard, this might help. It just shows the substitution.
<form>
<label>tjsnow</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="t_pod">
<label>t_pod</label>
<default>default_t_pod</default>
<initialValue>default_t_pod</initialValue>
<change>
<set token="t_pod">$value$</set>
</change>
</input>
<input type="text" token="t_host">
<label>t_host</label>
<default></default>
<change>
<set token="t_host">$value$</set>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
In your example, you can then do something like this:
index=MYINDEX subid=$t_submissionID$ msg=$t_messageType$
| eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$")
| where host=hostToken
... View more
