Here's the simple way to do this in search. You cannot modify _raw as indexed, but you could certainly do it as you outline for the current search. This run anywhere example assumes shows using the replace function to do the character substitution: | makeresults
| eval _raw="<some, other, text> SQL_TEXT=\"grant create database link to aaa01, bbb02, yyy03, xxx04\", <more,other,text>"
| rex field=_raw "SQL_TEXT=\"(?<sqltxt>.*)\""
| eval newsqltext=replace(sqltxt,",","$") Depending on how you have this datasource configured, you may already have a field called SQL_TEXT extracted, so you may not have to do the rex at all. Here's how you could do it following your approach: | makeresults
| eval _raw="<some, other, text> SQL_TEXT=\"grant create database link to aaa01, bbb02, yyy03, xxx04\", <more,other,text>"
| rex field=_raw "^(?<prefix>.+)SQL_TEXT=\"(?<sqltxt>.*)\"(?<suffix>.+)$"
| eval new_raw = prefix+"SQL_TEXT="+replace(sqltxt,",","$")+suffix
| fields _raw, new_raw HTH
... View more
