Better way of getting the series of events and all the field values

[macadminrohit]

Right now i am using the transaction command to get a sequence of events based on a common field value. The resulting event from the transaction command has multiple fields with the same field name but different values, which is expected as transaction command has group different events together. The issue i am facing is i am not able to extract out those individual field values from that clubbed event.
Not sure if eventstats or streamstats will be a better way of doing what i am trying to achieve.

[hortonew]

Are you trying to extract them via mvexpand (multi-value expand) or similar commands? Should be able to | transaction ... | mvexpand commonfield.

Also know if you're looking for a faster way to search and build these transactions, you can use a combination of eval to create a common field for ones that match via if/case statement, then doing stats command after.

[Sukisen1981]

can you please share a snap of what your data looks like and what is the expected search results?