Right.. but this breaks it for some reason..   index=_internal [| makeresults | eval component = "thru, cached, module, startup" | eval component = trim(split(component,",")) | format] ... View more

No luck. I still get no result found, but can run a search and find them individually.   ... View more

index=main [| makeresults | eval customer = "a, b" | eval customer = split(customer, ",") |fields customer |format ]   this doesn't give results...   having the entry  |eval customer = "a", "b", "c"   gives an error Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.   I assume it can't be formatted that way. ... View more

Please forgive me.. I am green as green can be.. do you mean... index=main  [| makeresults | eval customer = "OPT, ANT" | eval customer = split(customer, ",") | search customer]   i tried replacing the "search customer"  with just "format" neither worked. ... View more

This is working, but it isn't running the search. index=main [| makeresults | eval customer = "OPT, ANT" | eval customer = split(customer, ",") | format]   but the search isn't running. I can search for OPT alone  -- index=main OPT -- and get results, same for ANT, but this way.. i don't get anything back. ... View more

I get an error in the "eval" command for "customer=a,b,c" ... View more