Tried to find some related threads such as https://answers.splunk.com/answers/50659/whats-the-difference-between-where-and-search-in-the-pipeline.html ... View more

Thanks all for your answers; didn't expect so many answers in a short span 🙂 I now realize that Field Extraction would be a better choice, given that I actually need to be able to search on that extracted field (Calculated field is more for projecting the result I guess, I may be wrong). I had created an extracted field called "domainName" through "settings -> Fields -> Extracted Fields" as below: rex field=SourcePath "\/\w*\/\w*\/[a-zA-Z]*\_(?<domainName>[a-zA-Z0-9]*)" I had enabled read permissions for "search" app. But I'm not able to search on this domainName when I search with host=host123 domainName=domain123 , I don't get any results. Search with host=host123 SourcePath = "/org/app/comp_domain123_port_host" returns results though. Any clues ? Another query: I don't find the "portName" extracted field in Selected fields, or interested fields or all fields sections. Is any configuration required to make them appear there? ... View more