it's definitely a great option when you use the same search over and over with different arguments, especially if the search ever changes, you only have to change it in one place. ... View more

In an eval statement, strings have double-quotes ("string") and field names have single quotes ('field name'). So do this: eval STRINGBACK=[search source="FILE.csv" host="HOSTSERVER" sourcetype="csv" 'COLUMN NAME WITH SPACES IN CSV'="123" | table "COLUMN NAME WITH SPACES IN CSV"] Or better rename "COLUMN NAME WITH SPACES IN CSV" as new_name and then just use the new name everywhere. ... View more