I did not provide all the details (earlier I simplified my search), therefore, unfortunately, your SPL query will not work for me. 1) I'm using more complicated SPL query, and my goal is to use one tag for ALL the indexes, excluding index=cdc_apache, and use another tag for ONLY one index=cdc_apache. Why do I want to do it: I cannot combine hosts AND index in ONE tag, because they are combined by OR statement by default; I need to combine them the following way in a tag: index=datapower OR index=aaa OR index=bbb OR (index=cdc_apache AND (host=xxx, host=yyy, etc.)), but Splunk does not allow to do it. Therefore, my SPL query really looks like this (I NEED TO USE DIFFERENT HOSTS WITH DIFFERENT INDEXES): tag::index="ED_ENDI_ProdIndexED” | eval tag_name=case (index=="cdc_apache","ED_ENDI_Digital_Retail_WebS_Test", index !="cdc_apache", "ED_ENDI_ProdIndex_Test_1") | where isnotnull(tag_name) | eval tag=tag_name | where isnum(status) In the above query: tag “ED_ENDI_ProdIndexED” consists of the following field-value pairs: index=cdc_apache, index=cdc_jboss, index=xxx, …, index=yyy tag “ED_ENDI_Digital_Retail_WebS_Test” consists of the following field-value pairs: host=aaa, host=bbb tag "ED_ENDI_ProdIndex_Test_1" consist of the following field-value pairs: host!=aaa host!=bbb What I need as an output of my SPL query: I need to show the log entries, where there is a numeric “status” field, for all the indexes. BUT for index=cdc_apache I have to use ONLY two hosts OUT of five, for index!= cdc_apache I have to use a different set of hosts (there are VERY MANY of them), except for the host=aaa AND host=bbb. I realize that the above query does not work (it shows ALL five HOSTS for the index=cdc_apache – I tested it), but I don’t know how to change it in order to make it work. I also think, that it is NOT valid to put host!=aaa host!=bbb in the tag (even if it is a correct way to do it – doubt it though - it combines these two hosts with OR and I need AND). But I cannot list all the hosts in the “ED_ENDI_ProdIndex_Test_1” tag, because, a) they should be discovered automatically and b) there are too many of them. Please, advice. ... View more