Hi, I am a rookie in SPL and I have this general correlation search for application events: index="foo" sourcetype="bar" (fields.A="something" "fields.B"="something else") If this was a application specific search I could just specify the service in the search. But what I want to achieve is to use a service id from event rather than a fixed value to suppress results for that specific service. If I append  | `filter_maintenance_services("e5095542-9132-402f-8f17-242b83710b66")` to the search it works but if I use the event data service id it does not. Ex.  | `filter_maintenance_services($fields.ServiceID$)` I suspect that it has to do with  fields.ServiceID not being populated when the filter is deployed. How can get this to work?   ... View more