Hello, I've been struggling with this for way too long and it seems like it should be a fairly simple thing to do. I'm hoping someone here can help. SCENARIO: BaseSearch1 generates a table of [host, IsBlocked, IsHF, IsIDX] fields where host=string and the remaining are boolean (0 or 1). This represents a list of hosts that have either seen a queue block since [earliest=$global_time.earliest$ latest=$global_time.latest$], are a HF/DS, or are named ^idx-*. I will put the base search at the end of this posting to make it easier to read. MultiSelect1 uses ChainSearch1 linked to BaseSearch1 to present only the hostnames from BaseSearch1 where IsBlocked=1. Query:      | search IsBlocked=1      | table host Token:$tok_MultiSelect1$ OBJECTIVE: Create a datasource called ChainSearch2 for MultiSelect2 that will filter the following query using the hosts listed in $tok_MultiSelect1$, essentially like this Query: index=_internal (sourcetype=metrics OR sourcetype=splunkd) group=queue name=* host IN($tok_MultiSelect1$) | fields name | dedup name sortby name | table name ISSUES: Problem1 (Solved, basis for Problem2): Even though the base search feeding the MultiSelect1 chain search ends with " | table host IsHF IsBlocked IsIDX", I see the fields ["_time","host"] when using this query to evaluate $tok_MultiSearch1$ by sending it to a table: CODE: | makeresults | eval host_list="$tok_MultiSearch1$" ...which makes that output invalid for "host IN()" This was overcome with this query: | makeresults | eval host_list="$tok_MultiSearch1$" | fields - _time | makemv delim="," host_list | mvexpand host_list | fields - _mkv_child | eval quoted_host="\"" . host_list . "\"" | stats list(quoted_host) as quoted_hosts | eval host_filter=mvjoin(quoted_hosts, ",") | fields - quoted_hosts The result is that now host_filter = "server1","server2"   Problem2 (unsolved): This query WILL return the data I am looking for index=_internal earliest=-15m group=queue host IN ("server1","server2") | fields name | dedup name sortby name | table name However, if I use $host_filter for the server values (shown above in Problem1), even though it's a comma-delimited list of quoted server names, I get an empty output: | makeresults | eval host_list="$tok_MultiSearch1$" | fields - _time  | makemv delim="," host_list | mvexpand host_list | fields - _mkv_child | eval quoted_host="\"" . host_list . "\"" | stats list(quoted_host) as quoted_hosts | eval host_filter=mvjoin(quoted_hosts, ",") < where I get "server1","server2" | fields - quoted_hosts | search index=_internal earliest=-15m group=queue host IN ($host_filter) | fields name | dedup name sortby name | stats values(name) as Queues  I cannot seem to get $tok_MultiSearch1$ used properly in ChainSearch2. Again, I am guessing that this is going to be something simple that I've overlooked, it's just not coming to me. Thanks in advance for any help that can be offered! ... View more