Try: | eval t=if(tag="x" OR tag="y", tag, NULL)|top t Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself. Or, for multivalue fields, try: | eval t=mvfilter(match(tag, "x") OR match(tag, "y")) | top t ... View more

It sounds like you would be better served using a dropdown, if there are two choices that aren’t essentially true or false. But, you can accomplish this with a checkbox, as this run-anywhere example shows: <form> <label>Set value by checkbox</label> <fieldset submitButton="false"> <input type="checkbox" token="checked" searchWhenChanged="true"> <label></label> <choice value="yes">Check for A</choice> <delimiter> </delimiter> <change> <condition value="yes"> <eval token="checked_result_value">"A"</eval> </condition> <condition> <eval token="checked_result_value">"B"</eval> </condition> </change> </input> </fieldset> <row> <panel> <single> <search> <query>| makeresults | eval value="$checked_result_value$"</query> </search> </single> </panel> </row> </form> ... View more

Check also in etc/system/local , and if you don’t see them there check the output of: splunk btool props list <sourcetype name> --debug And: splunk btook transforms list <transform name> --debug ... View more

Check out the bottom answer on this recent answers post to see if it explains why what you're trying isn't working. Adding the pertinent text of the answer in question to make it easier to find: Lookups, even time-based lookups, don't (by default) enable searching by using the timepicker. However, if you have a time in your lookup file, you can somewhat fake what you may be looking for with a search like: | inputlookup server_purposes | eval _time=strptime(start_time, "%Y-%m-%d") | addinfo | where _time>=info_min_time and _time<info_max_time The addinfo command adds your earliest/latest times as chosen by the timepicker and puts them in the fields info_min_time and info_max_time , after which you can use the where command to search for _time values within that range. ... View more

Here is a solution to the regex, which considers the middle - somestring to be optional: https://regex101.com/r/TrXBUL/1 As for why your regex caused that error, you'd need to post the regex you used for anyone to give you an answer. Updated link that also grabs the middle value: https://regex101.com/r/TrXBUL/4 It was just a case of adding a named capture group for the portion of the optional group up until the space. ... View more