hi @ITWhisperer , thanks for your answer , I have the following query: (sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name="myserver_name" OR (object__Name="myserver_name*") OR (location__Name="*myserver_name*")) What I am trying to achieve is to assign the value "myserver_name" to a variable (e.g., servername) in order to avoid repetition. This way, if I need to modify the query, I only have to update the declared variable. I am looking for something like this: | eval servername = "myserver_name" (sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name=servername OR (object__Name=servername) OR (location__Name=servername)) This would allow me to use the variable servername instead of repeating the value "myserver_name" multiple times in the query. i hope that it's clear now !
... View more