Below search works: index=_* | eval SPLITid=[search index=_audit | eval tempid=substr(id,2,5) | return $tempid] | table SPLITid But next one did not work for me when I changed the field name: index=_* | eval SPLITid=[search index=_audit | eval tempid=substr(source,2,5) | return $tempid] | table SPLITid So, I will suggest you to lookinto substr command. Put it in between " " like below: "substr(source,2,3)" Working search: index=_* | eval SPLITid=[ search index=_audit | eval tempid="substr(source,2,3)" | return $tempid] | table SPLITid I hope you will find it helpful!! ... View more