Yes you can. Short answer, add a comma in the brackets.
Long answer...
This is caused by labels, by default Logscape uses the name of the column as the Label for your chart. Whilst this may be accurate, you may not want a label at all or you may wish to choose a different one.
Let's say as an example, your search is as follows:
* | _tag.equals(logscape-logs) _filename.count()
You have not given Logscape a label here, so all your results should look like this = _filename_FILENAME (where FILENAME is agent.log, dashboard.log etc)
* | _tag.equals(logscape-logs) _filename.count(_host) provides results like this = _filename_HOSTNAME_FILENAME
You have chosen to break it down by Host (so you get more defined results) but not provided a label, so you still get _filename at the start.
Now try * | _tag.equals(logscape-logs) _filename.count(_host,LABEL). Your results should now be LABEL_HOSTANME_FILENAME
Anything after the comma is taken to be the label. You can actually use those labels for .gt or .lt operations as well.
To strip the label, try this: * | _tag.equals(logscape-logs) _filename.count(_host,) Your label is now blank.
