I am extracting a list of free text string in the _ raw and creating a new field. The list of terms comes from user input, on the search input of a dashboard.  I cant seem to find how to place the token/variable in the regex... probably something easy im missing. $token$="test|google|domain|badguy"      (formmated this way so regex can see it as OR separated list) rex field=_raw " (?<extractedfieldname>$token$) (does not work) Is there a way to do this? if not a token option, can i: eval tokenname=$token$ rex field=_raw " (?<extractedfieldname>'tokenname') (does not work) After the token/variable is placed correctly this is the search format im looking for: rex field=_raw " (?<extractedfieldname>test|google|domain|badguy) (this does work) thanks for any help! ... View more

Hi I am running into a problem when it come to subsearches. I want to use results from the first search to plug into the second search. The uid/keyvalue  ties multiple sourcetypes together, with each sourcetype comes similar and unique information. It would be great to correlate this info by a table or stats.  FYI Both sourctypes have an uid field dns sourcetype has the contains query field conn sourcetype has the other fields wanting display index="main" sourcetype=conn uid=keyvalue  [ search index="main" sourcetype=dns          | rename uid as keyvalue           | table keyvalue] | fields proto, query, id.orig_h | table uid, query,  proto, id.orig_h ... View more