Hello, I'm attempting to use a drilldown to search. The original search renamed some fields in order to improve the display in the dashboard, and so in the drilldown search query I'm attempting to do something like (the search includes a wildcard): eval searchTerm = case("Renamed Value One", "value1*", "Renamed Value Two", "value2*") This is causing the search to not return any results. I think the eval statement is where it's not working as I expect. If I do: sourcetype="index" | spath typeId | search typeId=value1* ... then I get the results I expect. But if I use: sourcetype="index" | eval new_typeId=value1* | spath typeId | search typeId=new_typeId ... then no results are returned. (I tried both with and without the spath command I used this answer https://answers.splunk.com/answers/494424/search-using-variables.html as the model for it, but that uses where , which does not allow for wildcards. How can I use the variable later in a search, when it contains a wildcard? Thanks! ... View more