Hi, Could someone help on the below requirement. I have the index as sampleindex and which returns the one of the output called environment_name as app1_dev, app1_tst, app1_prd, app2_dev, app2_tst, app2_prd, app2,dev, app3_tst, app3_prd. along with few more outputs, i have to bring the timechart with environment_name and cost on given duration. Here I am not interested on all environment, for example i need to get the result only on app1_dev, app2_dev and we don't want to show app3_dev when i am selecting the Environment name as "dev". Same applies for all environment. And the above given environment combination is just an sample, i have around 10+ environment(dev, int, tst, prd, etc...) with combination of 10 application (app1, app2, app3, etc..,) I have to use Dropdown as Input field and choice as , to group all the environment type as below. <label>Environment</label> <choice value="*dev">dev</choice> <choice value="*tst">tst</choice> <choice value="*prd">prd</choice> <default>*prd</default> </input> When i select the value as "dev", the chart should show the output as app1_dev, app2_dev and app2_dev on chart . Could someone help on how to query this. I have tried using case statement, but which returns as sum based on environment namings what i selecting from dropdown.. eval namespace=case(match(environment_name,"app1-dev"),"dev", match(environment_name,"app2-dev"),"dev", match(environment_name,"app3-dev"),"dev") Re phrased the question again. ... View more