How to use eval reference in rex command. Here is what I have tried so far: MyMacro: myrextest(1)   | eval test= "Hello" | eval myinput = $myinput$ | eval rexString = "'$myinput$':'(?<$myinput$>[^*']+)" | rex field=payload "'$myinput$':'(?<$myinput$>[^*']+)"   Search String without eval and it is working fine :   | eval payload = "{'description':'snapshot created from test','snapShotName':'instance1-disk-2-cio- 1564744963','sourceDisk':'instance1-disk-2','status':'READY'}" `myrextest("snapShotName")`   output from search string:   rexString: 'snapShotName':'(?<snapShotName>[^*']+)   Search String with eval:   | makeresults | eval payload = "{'description':'snapshot created from test','snapShotName':'instance1-disk-2-cio-1564744963','sourceDisk':'instance1- disk-2','status':'READY'}" | eval myMacroInput = "snapShotName" `myrextest(myMacroInput)`   output from search string:   'myMacroInput':'(?<myMacroInput>[^*']+)   Based on my observation when I am passing eval reference to my macro and using it in rex it is not replacing the value it is replacing with eval reference. Can some one please help me on it, I have tired a lot but unfortunately I didn't get any solution . ... View more

How to loop the array values after split with delimiter  | eval json="{"key1":"key1value","key2":"key2value","key3":"key3value","key4":"key4Value" }" | eval keyNames ="key1,key2,key3,key4" // key names can add or remove based on search string the requirement   | eval keys=split(keyNames ,";") How to loop these keys and perform some operation.  I have tired with some MV commands but no luck. Example:  | eval count = mvcount(keys) | streamstats count as counter | eval jsonKey= mvindex(keys,count) | eval keyValue = json_extract(json, jsonKey) I am not sure how to achieve this use case, can some one please help me on it.   ... View more