We continue to make progress. The rex command merely extracts fields.  The extracted fields are added to the existing set of fields.  To control which fields are shown in the results, use the fields or table command. source="test.csv" | rex field=raw_line "sblogin/(?<extracted_string>[^\"]+)" | eval extracted_string=substr(extracted_string, 9) | table extracted_string BTW, the substr function is looking for the 9th character in extracted_string.  In the example data, extracted_string is "username", which doesn't have 9 characters so substr returns nothing. ... View more