Thanks for the above info about using like. I ran into this issue when trying to match a field value inside an if.   eval Environment=if( host="*beta*","BETA","PROD" )   This returns all events with the Environment field value as PROD.   It worked as expected once I changed to:   if( like( host, "%beta%" ), "BETA", "PROD" )   ... View more