I have a table that shows instances of errors from the event log over time by host. I use a drop down that searches the event log data for Type="Error" | top limit=20 Message to populate $ErrorMessage$ with the value in the Message column. Then I have a table that uses $ErrorMessage$ and does this search: Type="Error" Message ="$ErrorMessage$" | eval host=upper(host) | timechart count by host The table and the drop down both default to 24 hour periods. It works, except when the Message contains reserved characters, like [ or ]. Then I don't get any matches, even though results show in the drop down. Do I need to escape characters in $ErrorMessage$ when I do my search for the timechart? If so, how do I do that without knowing what characters will show up or how many? ... View more