The following is my ideal final query to be used in a dashboard.     index=cdn_app httpMessage.host=taxes* | eval _env=$env_host$ | eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") | search httpMessage.host=_hostName | spath output=status path=httpMessage.status | eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status   It seems `_hostName` is not resolving even when I hardcode and values like so.     index=cdn_app httpMessage.host=taxes* | eval _env="taxes.sf.com" | eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") | search httpMessage.host=_hostName | stats count by httpMessage.host   I'm sure its with my eval case because this works just fine.     index=cdn_app httpMessage.host=taxes* | search httpMessage.host="taxes.sf.com" | stats count by httpMessage.host   Open to any suggestions. Thanks!     ... View more