The search command cannot accept a field name on both sides of the =.  Use where, instead. index=... | eval field1="1.2.3.4:100" | rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)" | table user_ip user_port | where (index_field1=user_ip AND index_field2=user_port) | table index_field1 index_field2 user_ip user_port ... View more

Hi @gcusello Thanks for your response 🙂 Exactly, your understanding is good. We are going to check the configuration files related to the sourcetypes, both TA are already installed. I will come back to you soon Yanis ... View more

@yanisA Hope it helped, Appreciate if you could Accept solution. ... View more