Hi guys, I'm new to splunk and I have one issue with filtering my search results based on a case condition My search string: sourcetype="WMI:CPUTime" | eval selected_host=case("$ddl_instance$" == "a", "Server1", "$ddl_instance$" == "b", "Server2", "$ddl_instance$" == "c", "Server3") | timechart span=1d eval(round(avg(PercentProcessorTime),1)) by host limit=20 I now I need to filter this based on the field named host=selected_host It doesn't sound very complex but I cannot make it work. Thank you, Andrei ... View more