Is there a way to embed the same into this query? rex field=logLine "(Error Occurred During Script|UnhandledException ->)(\s|\S)(?<errorMessage>.*)"   This didn't work, but something like this? rex field=logLine "(Error Occurred During Script|for job id \'\w*\d*\' :|UnhandledException ->)(\s|\S)(?<errorMessage>.*)"

Looks like there is a syntax error "search" keyword  I removed it and tried with below, however,  the output has all the data from index. We are only interested to output data from index - that is not present in lookup. index=index country_name | table country_name | join type=left country_name [ | inputlookup | stats count as Exist by country_name] | fillnull Exist value=0 | where Exist=0  

Couldn't able to test this, but should work. Please let me know if it doesn't work. index=index country_name | table country_name | join type=left country_name [search | inputlookup | stats count as Exist by country_name] | fillnull Exist value=0 | where Exist=0  

There is a potentially rather expensive way to do it.  Suppose your raw events are all single lines, you can do something like   | eval beginning_of_transaction = mvindex(split(_raw, " "), 0) ``` use index -1 for end of transaction ``` | rex field=beginning_of_transaction "<your regex>"   If the events are not all single line, but there is a distinct string (including newline) to split them without interfering with your regex, this formula can still work. Update: Your title says to exclude.  If exclusion is the goal, I assume that you meant to exclude start AND end, not start or end.  This can be achieved with | eval middle_of_transaction = mvindex(split(_raw, " "), 1, -2) | rex field=middle_of_transaction "<your regex>"  

Hi, Try something like this, hope it works. You can hide the table and use the token on your panel title. <row> <panel> <table depends="$hide$"> <title>$Time_Period_Start$ $Time_Period_End$</title> <search> <query>| makeresults | addinfo | eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S") | table SearchStart, SearchEnd</query> <earliest>-7d@d</earliest> <latest>@d</latest> <done> <set token="Time_Period_Start">$result.SearchStart$</set> <set token="Time_Period_End">$result.SearchEnd$</set> </done> </search> </table> </panel> </row>