@vikasverma  passing variable things to other things is not easy, other than in the field pipeline, but as @richgalloway  pointed out, the map command can do this, but there is another technique where you can do this sort of thing. | makeresults | eval row="host1; Sun=1, Mon=2, Tue=3, Wed=4, Thu=5, Fri=6, Sat=7" | eval today=strftime(now(), "%a") | foreach today [ rex field=row "<<FIELD>>=(?<mday_rex>\d+)" ] | foreach today [ eval mday_replace=replace(row,".*".<<FIELD>>."=(\d+).*", "\1") ] In the above, the foreach statement is used to pass the field value to the subsearch, however, the REX statement does NOT work and mday_rex is null, I don't know why, but the second form, where the replace statement is used, DOES work and the mday_replace field is set correctly. That's just capturing today's day=X value using regex and removing all other text.   ... View more