Hi @akil8295, did you explored the choice to use calculated fields or automatic lookups? so id you have some ID values in the error field, you could create a calculated field like this: | eval ID=if(match(error="%12345%","12345",ID) in this way you can create an ID value using what you find in the rrror field. If the are too many to manage with one or more evals, you can use an automatic lookup (https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Makeyourlookupautomatic). Ciao. Giuseppe ... View more