This is the search that I'm trying to do but it does not return anything. I'm trying to create a string variable and referencing it in a search so that I don't have to retype it eight times. And if I wan't to change the string, I only have to do it once. | eval subnet="207.45.47.0/24" | search src_ip=subnet OR source_address=subnet OR src_translated_ip=subnet OR nat_source_address=subnet OR dest_ip=subnet OR destination_address=subnet OR dest_translated_ip=subnet OR nat_destination_address=subnet Is this allowed or is there a better way of doing it? ... View more