So, when I try the suggested query, using the generated makeresults.... it works like a charm, as expected. When I then pull from the index/sourcetype for the same data, but leave the eval statement that generates the "eventTime" field... it still works. However, once I remove this line: | eval eventTime="2023-02-20T22:33:00.000Z" And just use whatever value already comes in the eventTime field... it breaks again. This makes me feel like it is not coming in the exact format expected, maybe an extra space or tab somewhere in there... so I put together a very tight regex and used SED to replace whatever it found with the expected pattern, and it still broke. I then built a query that dumps out each of the stages... and everything works right up until I attempt to do some sort of math function. So in this example: | makeresults | fields - _time | eval eventTime="2023-02-20T22:33:00.000Z" | rex field=eventTime mode=sed "s/.*(\d{4}\x2d\d{2}\x2d\d+T(?:\d{2}\x3a){2}\d{2}\x2e\d+Z).*/\1/g" | eval eventTime1=strptime(eventTime,"%Y-%m-%dT%H:%M:%S.%3QZ") | eval eventTime2=strftime(eventTime1, "%+") | eval event_etime=strptime(eventTime2, "%a %b %e %H:%M:%S %Z %Y") | rex field=event_etime "^(?P<event_etime2>\d+)" | eval event_etime3=tonumber(event_etime2)+1 | eval event_etime3=if(isnull(event_etime3),"null",event_etime3) | table eventTime eventTime1 eventTime2 event_etime event_etime2 event_etime3 It works great. However once I remove the first 3 lines, and replace it with my index search... "event_etime3" shows up with "null" as the value (because of the "if" statement to add in "null" when null): | rex field=eventTime mode=sed "s/.*(\d{4}\x2d\d{2}\x2d\d+T(?:\d{2}\x3a){2}\d{2}\x2e\d+Z).*/\1/g" | eval eventTime1=strptime(eventTime,"%Y-%m-%dT%H:%M:%S.%3QZ") | eval eventTime2=strftime(eventTime1, "%+") | eval event_etime=strptime(eventTime2, "%a %b %e %H:%M:%S %Z %Y") | rex field=event_etime "^(?P<event_etime2>\d+)" | eval event_etime3=tonumber(event_etime2)+1 | eval event_etime3=if(isnull(event_etime3),"null",event_etime3) | table eventTime eventTime1 eventTime2 event_etime event_etime2 event_etime3 Any sort of math function seems to break it, and that field has a value up until the attempted math. ... View more

Thank you so much! This did the trick! ... View more

This was part of the issue that was causing lookups to not return anything. I created a lookup definition and removed the case sensitivity requirement. ... View more

@jboselly I did end up getting it to work! For me, there were two issues going on... from what I can remember. The first issue was that the lookups that were being affected were really large. I am in a clustered environment and the lookups were not replicating properly. Our admins got that part fixed. If I am remembering correctly, the temporary fix was to add the optional argument of "local=true" to force the lookup to run on the search head instead of anything remote. The other issue was that I didn't understand at that time that while it is said that "field NAMES are case sensitive, but field VALUES are not"... that is untrue for key/value pairs in lookup files by default. To change that, you must create a lookup definition, then go into the advanced settings, and turn off case sensitivity. Once we resolved those two issues, the lookups started returning the expected results. Hopefully this helps! ... View more

Thanks for pointing me to the calculated field section, I was able to get the result without using a regex, but instead just created the eval expression to say "domain_name + uri_path + uri_query" and called it "url". ... View more

Yeah, that was working great added to a search, but what I wanted was a parsed field all ready to go without having to add that search into every spot. ... View more

Thank you so much! I toyed around with this for a while and eventually just came here. I just needed to add a table at the end and it came out perfect. Thanks again! ... View more

Thank you! I was missing the table part when trying to figure this out. ... View more