Hi all, Is it possible pass multiple value to a Token from one search to another? This is what I try to do. First Panel search: Index="some_DHCP" | where src_hostname like "1-computer" | search src_ip=* | dedup src_ip | table src_hostname src_ip src_hostname src_ip 1-computer 10.0.0.1 1-computer 10.0.0.2 From this search I might have one or more src_ip, depending on timespan, and want to use them both in next search in an other Panel. So far I have done like this to pass to next serach: <done> <set token="IP_answ">$result.src_ip$</set> </done> Second Panel search: Index="some_FW" src_ip="$IP_answ$" dest_ip=* | table src_ip dest_ip As it is now I will only have 1 IP (latest) to pass to the next Panel search "IP_answ". And I can understand that, but I can not find any solution when I searching the web or this community how to solve this with multiple values and Append the second IP to the second Panel. Any suggestions? Thanks in advance and regards, /Tomas
... View more