the large size logs like as below it's not a regular json data, therefore need to using rex to get fields A logs have name and uid B and C logs have uid and oid the dashboard accept input name, it allow multiple name with comma then using the name to find the uid and figure out the related uid and oid data from B logs and exclude from c logs so, I don't know how to  1. in a search statement substitute using the value of users be a keyword 2. combine the field data with comma for using  function search data in (...)    Thanks. -- for example: A logs: ... x1 ...uid=123... ... y2 ...uid=456... ... z3 ...uid=789... B logs: .... oid=989 ...uid=123 ... .... oid=566 ...uid=456 ... .... oid=486 ...uid=789 ... C logs: ...cancel_order... oid=989 ...uid=123 ... ...cancel_order... oid=566 ...uid=456 ... ...cancel_order... oid=486 ...uid=789 ... a dashboard has a input box text: users, and user can input multiple users with comma the value of users will be like "x1,z3" I wont to put the value in a search statement such us | makeresults | eval users="x1,z3" | eval names=replace(users, ",", " OR ")    =>excepted result: x1 OR z3 | search source="alog" $names$     => Substitute the names value into keyword | rex "name=(?<name>\S+)" | rex "uid=(?<uid>\d+)" | table name,uid | join type=left max=0 uid [ source="blog"  | rex "uid=(?<uid>\d+)" | rex "oid=(?<oid>\d+)" | search uid in (uids)    => uids combin the uid values with comma ex: (123,456,789) | table uid,oid ] | join type=left max=0 oid [ source="clog" cancel_order | rex "uid=(?<uid>\d+)" | rex "oid=(?<oid>\d+)" | search uid in (uids)    => uids combin the uid values with comma ex: (123,456,789) | table uid,oid,status ] | where isnull(status) | stats count(oid) by name ... View more