Hello All, I have a problem with my search. The following search works:   index=test_index sourcetype=test_sourcetype | search Modulename IN ("Test_One","Test_Two")    However, this search does not work:   index=test_index sourcetype=test_sourcetype | eval helper_modulename = replace("Test_One&form.Modulename=Test_Two", "&form.Modulename=", "\",\"") | eval helper_modulename = "\"" . helper_modulename . "\"" | search Modulename IN (helper_modulename)   The result of helper_modulename is the same string I use in the search that works: Can anyone tell me what I am doing wrong and what needs to be adapted to make it work? 🙂 Thank you all in advance! ... View more