Hello, I have extracted three fields: Name , Type and Environment . Each of those fields is has multiple values. For example: Name = "fw.infra.prctrl.ClientStarter" (and more following this layout) Type = "somestuff.OLDTYPE.morestuff" Type = "somestuff.NEWTYPE.morestuff" Environment = "env A" Environment = "env B" Eventually, I want to combine those fields into a new field named NameOfApplication . The way I have done that, was by using the "Calculate Fields" Option with the eval Operation: "*Name + " - " Type" + " - " + "Environment*" As expected, the result was for example: "fw.infra.prctrl.ClientStarter - somestuff.NEWTYPE.morestuff - env A" But that is too long for my needs and I would like to have it in this way: "Application One - NEWTYPE - A" That's because I will use NameOfApplication in a Chart. So I have to tell Splunk that "fw.infra.prctrl.ClientStarter" means "Application One" and that I have to shorten the other fields. I know this is possible in the search bar by using "replace" or "rex" commands, but the field NameOfApplication is created with the "Calculate Fields" Option in SplunkWeb, so changing the values of the fields in the search bar won't affect the new field. Also, changing this manually in the search bar for every possible result might get too much, so doing it automatically would be great. How can I achieve my goal the best way? Changing the way completely wouldn't mind at all 🙂 Thanks for your help! ... View more