What I did to accomplish my variant of the starting question was to output an eval-field from the search that I used as throttle field.
| eval throttleId = a_field_from_the_search + "_" + another_field_in_the_search
Throttle expression was then: throttleId
The eval-field could use just about any logic, the threadstarter would possibly use the replace(X,Y,Z) function to strip out the log number.
... View more