https://community.splunk.com/t5/Splunk-Search/How-to-use-the-field-in-search-query-EXTRACTED-using-REX-command/m-p/343910#M101879 <P>It worked!!!</P> Wed, 20 Sep 2017 21:10:24 GMT rangineniarunku 2017-09-20T21:10:24Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-field-in-search-query-EXTRACTED-using-REX-command/m-p/343908#M101877 <P>I have a field named "content" with multiple values to it as follows<BR /> content=value.deva<BR /> content=value.devb<BR /> " =value.devc ......<BR /> I have written a rex expression in my search query .........| rex field=Name ".(?.*)" to extract the Environment from the field content . Now I want to get the values in my result only for Environment=deva, how can I use the field Environment in my query?<BR /> I tried this way but it did not work ".........| rex field=content ".(?.)" | Environment=deva "</P> <P>Can someone help me with this?</P> Wed, 20 Sep 2017 19:11:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-field-in-search-query-EXTRACTED-using-REX-command/m-p/343908#M101877 rangineniarunku 2017-09-20T19:11:18Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-field-in-search-query-EXTRACTED-using-REX-command/m-p/343909#M101878 <P>You are looking for the <CODE>| where</CODE> command.</P> <PRE><CODE>| where Environment="myvalue" </CODE></PRE> Wed, 20 Sep 2017 19:26:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-field-in-search-query-EXTRACTED-using-REX-command/m-p/343909#M101878 DalJeanis 2017-09-20T19:26:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-field-in-search-query-EXTRACTED-using-REX-command/m-p/343910#M101879 <P>It worked!!!</P> Wed, 20 Sep 2017 21:10:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-field-in-search-query-EXTRACTED-using-REX-command/m-p/343910#M101879 rangineniarunku 2017-09-20T21:10:24Z