I have tried multiple methods to get a complex URL to work as a redirect. Unfortunately, there are a lot of different base URLs in my actual data so using multiple conditions is probably not a good option. It seems as though it wants no "/" in the URL field, only parameters. <dashboard> <label>URL Test</label> <row> <panel> <table> <search> <query>| makeresults count=3 | streamstats count | eval url = case(count=1,"https://bing.com",count=2,"https://google.com",count=3,"https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;results_type=overview&amp;search_type=all&amp;cpe_vendor=cpe%3A%2F%3Aapache&amp;cpe_product=cpe%3A%2F%3Aapache%3Alog4net&amp;cpe_version=cpe%3A%2F%3Aapache%3Alog4net%3A1.2.9.0") | eval site = case(count=1,"bing",count=2,"google",count=3,"nist") | table site, url</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <fields>["site"]</fields> <drilldown> <eval token="u">replace($row.url$, "https://", ""</eval> <link target="_blank"> <![CDATA[ https://$u$ ]]> </link> </drilldown> </table> </panel> </row> </dashboard>   ... View more

Both queries work on our non ES server; however, only the first query works on our ES server. This query works in both places: index=myIndexFile | head (1==1) | lookup myserverlist my_host This query throws the following error on our ES server: Streamed search execute failed because: "[IndexServerName] Error in 'lookup' command: Could not construct lookup 'myserverlist , my_host'. See search.log for more details.." I've looked at the search.log file and found nothing useful. index=myIndexFile | lookup myserverlist my_host ... View more