Hi @gcusello , As said, in the end it worked by editing the /opt/splunk/etc/system/local props and transforms files So the regex was correct after all, I didn't have to escape the "=" sign. Thanks for the suggestion though! Regards, ... View more

Finally, I got it right, the search below does what I need: index=proxy category="malware" | map maxsearches=15 search=" mymacro($query$) " | join type=left query [search index=proxy category="malware" | stats count by src_ip, query, risk.score the macro: rest splunk_server=local /services/3rdpartyapp/lookup_domain/$domain$ fields="entity,risk" | rename entity.name as query ... View more