Extract the search key (The hex string you have redacted) using either split or rex to a field called keyID substituting search_name for whatever the field is called in your data. | eval keyID=mvindex(split(search_name, " - "), 1) OR | rex field=search_name "Indicator - (?<keyID>[^\s]+) - " Then you can use the ITSI API endpoints to tie them to the base searches: | join type=left keyID
[| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval title = spath(value, "title"), keyID = spath(value, "_key"), frequency = spath(value, "alert_period")
| fields title, keyID, frequency ]
... View more