As per my question yesterday, I thought I had all of my problems resolved. I since discovered that when I do mvexpand on the raw data it does not break out the individual values.
Restating the problem from before, I need to group events together and eliminate transactions, and then perform stat functions on the remainder. The suggestions I've seen are to add the mvraw=t option to the transaction command before doing mvexpand.
If I had 42 values in a field called ProblemID from 42 events originally, I would end up with a copy of all 42 values in each of the new events created by mvexpand. I need to either find a way to break the transaction out into the original events or at least just be able to perform stat calls on the raw data as though they were the original events.
Hope that makes sense.
EDIT Nevermind. I see now that the transaction command is NOT going to be useful to me in this instance. The problem is that for each event for a given asset there is a value associated with it. I need to sum those values up, but transaction will combine like values and thus give me a wrong answer when I act on the compressed information. I will probably just have to just have a very long-running search and deal with it. (this is a scheduled search anyway)
