Hi @ecterion06, the easyest way is to permanently extract these fields, as @to4kawa said, using the Field extractor or creating a new field [Settings -- Fields -- New] using your regexes. If instead you need of these fields only in one dashboard, you can use the Post process Search, creating a base search with your search and the field extraction and then use it for your panels; you can find infos at https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/Savedsearches#Post-process_searches_2 or (better) installing the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ) where it's how to. Ciao. Giuseppe ... View more