https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-use-tokens-in-rex-fields/m-p/511887#M34133 <P>I don't see why not - easy enough to test - just make a dashboard with a text input token spec_ip and see. See this</P><LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;test_ip&lt;/label&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="text" token="spec_ip" searchWhenChanged="true"&gt; &lt;label&gt;IP format&lt;/label&gt; &lt;default&gt;\d+\.\d+\.\d+\.\d+&lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;table&gt; &lt;title&gt;Parsing IP address with $spec_ip$ format&lt;/title&gt; &lt;search&gt; &lt;query&gt;| makeresults | eval IP=(random()%256).".".(random()%256).".".(random()%256).".".(random()%256) | rex field=IP "(?&amp;lt;ip2&amp;gt;$spec_ip$)" | eval format=$spec_ip|s$&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;false&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;true&lt;/option&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE><P>&nbsp;</P> Fri, 31 Jul 2020 06:08:20 GMT bowesmana 2020-07-31T06:08:20Z https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-use-tokens-in-rex-fields/m-p/511775#M34117 <P>Hi,&nbsp;</P><P>Is it possible to use tokens in rex fields like this?<BR /><BR />| rex "\d{1,2}-\S{3}\s\d{2}:\d{2}:\d{2}.\d{3}\s\S{3}\s\[(?&lt;ip2&gt;<STRONG>$spec_ip$</STRONG>)\]\s%NICWIN-4-Security_560_Security[\S\s]+?(?&lt;log_time2&gt;(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s\d{2}\s\d{2}:\d{2}:\d{2})[\S\s]+?\S*Object\sName:\s(?&lt;object_name2&gt;[\S\s]+?)New\sHandle\sID[\S\s]+?Primary\sUser\sName:\s(?&lt;username2&gt;[\S\s]+?)\s+"<BR /><BR /><BR /></P> Thu, 30 Jul 2020 14:50:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-use-tokens-in-rex-fields/m-p/511775#M34117 codywsj 2020-07-30T14:50:37Z https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-use-tokens-in-rex-fields/m-p/511887#M34133 <P>I don't see why not - easy enough to test - just make a dashboard with a text input token spec_ip and see. See this</P><LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;test_ip&lt;/label&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="text" token="spec_ip" searchWhenChanged="true"&gt; &lt;label&gt;IP format&lt;/label&gt; &lt;default&gt;\d+\.\d+\.\d+\.\d+&lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;table&gt; &lt;title&gt;Parsing IP address with $spec_ip$ format&lt;/title&gt; &lt;search&gt; &lt;query&gt;| makeresults | eval IP=(random()%256).".".(random()%256).".".(random()%256).".".(random()%256) | rex field=IP "(?&amp;lt;ip2&amp;gt;$spec_ip$)" | eval format=$spec_ip|s$&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;false&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;true&lt;/option&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE><P>&nbsp;</P> Fri, 31 Jul 2020 06:08:20 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-use-tokens-in-rex-fields/m-p/511887#M34133 bowesmana 2020-07-31T06:08:20Z