Federica, looking at your framework question, the reason those won't work is because you're not creating the field.
For your reference, it'll benefit you in the long term.
rex "\[(?P<path>[^\]]*)\]"
The < path > part of the rex, creates the field called path
Using the example you supplied, this is missing.
search: mvc.tokenSafe ("index=waratek source=$sourcename$ File:read | rex '[[^*](?.+)]' | fields path | outputlookup read_rules.csv")
Try:
search: mvc.tokenSafe ("index=waratek source=$sourcename$ File:read | rex '\[(?P<path>[^\]]*)\]' | fields path | outputlookup read_rules.csv")
Credit to @richgalloway for the rex statement.
... View more