Hey @Kubousky, If the field coordinatorsID is present as a column of the table, try expanding the field using mvexpand first, and then extract the field expertiseLevel from the coordinatorsID using regex. This will create a separate column for the expertiseLevel and then you can filter your data using the search command. Roughly your query should look something like this <<your_base_query>> | mvexpand coordinatorsID | rex field=coordinatorsID "[a-zA-Z]##(?<expertiseLevel>\d)" | search expertiseLevel="3" ... View more

Hi @Kubousky, good for you, see next time! Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more