how to break our comma separated values in results

[Dallastek1]

Im trying to break out the comma separated values in my results but im brain farting. I want to break out the specific reasons - {New Geo-Location=NEGATIVE, New Device=POSITIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}

index="okta" actor.alternateId="*mydomain*" outcome.reason=*CHALLENGE* client.geographicalContext.country!="" actor.displayName!="Okta System" AND NOT "okta_svc_acct"
| bin _time span=45d
| stats count by outcome.reason, debugContext.debugData.behaviors
| sort -count

outcome.reason	debugContext.debugData.behaviors
Sign-on policy evaluation resulted in CHALLENGE	{New Geo-Location=NEGATIVE, New Device=POSITIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}
Sign-on policy evaluation resulted in CHALLENGE	{New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}
Sign-on policy evaluation resulted in CHALLENGE	{New Geo-Location=NEGATIVE, New Device=POSITIVE, New IP=POSITIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}
Sign-on policy evaluation resulted in CHALLENGE	{New Geo-Location=POSITIVE, New Device=POSITIVE, New IP=POSITIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=POSITIVE}
Sign-on policy evaluation resulted in CHALLENGE	{New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=POSITIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}

[Dallastek1]

That worked! thanks!

[richgalloway · Accepted solution]

The split function can break up the field for you.

index="okta" actor.alternateId="*mydomain*" outcome.reason=*CHALLENGE* client.geographicalContext.country!="" actor.displayName!="Okta System" AND NOT "okta_svc_acct"
``` The trim function removes the braces from the ends of the field ```
| eval behaviors=split(trim('debugContext.debugData.behaviors', "{}"),",")
| mvexpand behaviors
| bin _time span=45d
| stats count by outcome.reason, behaviors
| sort -count