Try this rex command out, you'll need to go up to z of course:   | makeresults 1 | eval your_field="abc4ef" | rex mode=sed field=your_field "s/a/1/g s/b/2/g s/c/3/g s/e/5/g s/f/6/g" ... View more

And use this to make the columns the original names rather than the values(abc) result:   | rename values(*) as *   Thanks! If this solves it please mark as answered. ... View more

You can try the below to see a full search:   | makeresults 1 | eval CartridgeType="User" | eval Cartridge="Alpha" | eval Environment="DEV" | eval Application="A-1" | eval Version="1.1" | table Environment, Application, CartridgeType, Cartridge, Version | eval {Environment}:{Application}=Version | fields - Environment, Application, Version   This should generate a table like below:   CartridgeType Cartridge DEV:A-1 User Alpha 1.1  ... View more

Sorry, you need to bring the two fields you're using into the table, then drop them later to do it like that!   You can then use the fields command to remove them from the table.   index="main sourcetype="data" | table CartridgeType, Cartridge, Environment, Application | eval {Environment}:{Application}=Version | fields - Environment, Application ... View more

Version should be surrounded in single-quotes (') rather than double-quotes (") to use the value of the Version field. You don't need these single-quotes, so you can remove them if you prefer. If you also table out and then eval the fields after they will automatically appear in the table, so the below should work:   index="main sourcetype="data" | table CartridgeType, Cartridge | eval {Environment}:{Application}='Version'     The second line is also valid like below (no quotes): | eval {Environment}:{Application}=Version ... View more

| eval {Environment}:{Application}='Version' ... View more

Yep! It has proxy configurations available in the app. ... View more