Hi rjthibod, after seeing your example, tried it, received an error (tried my best to understand the query analyzer but i'm not quite there yet)
read up on what format did and what replace did and tried this way as the native result of format is always OR and it worked!!
sourcetype="error log" "SOAP Request before sending" [search sourcetype="error log" specific_error_code | rex field=_raw "AccountID(?\d+)/AccountID" | stats count by A1 | fields + A1 | format | eval search =replace(search, "A1=", "")]
many thanks for leading me down the right path!!
... View more