Hello Daniel, I found that using the command replace you can create a calculated field called dest. | eval dest = replace(replace(dnsQuery,"\(\d+\)","."),"^\.|\.$","") On the first replace you eliminate all the number rounded by parenthesis, and on the other replace you eliminate the first and the last period. So on Cloud you only need to create a calculated field and put the function replace, just like this replace(replace(dnsQuery,"\(\d+\)","."),"^\.|\.$","") I hope it helps other Splunkers to solve this issue or other similar.
... View more