Try something like this: <your search> ...
| eval exam_result=mvzip(ExamID, Status, "~")
| fields - ExamID Status
| mvexpand exam_result
| eval ExamID=mvindex(split(exam_result, "~"), 0), Status...
See more...
Try something like this: <your search> ...
| eval exam_result=mvzip(ExamID, Status, "~")
| fields - ExamID Status
| mvexpand exam_result
| eval ExamID=mvindex(split(exam_result, "~"), 0), Status=mvindex(split(exam_result, "~"), 1)
| eval extra_status = if(ExamID>=120 AND ExamID<=125 AND match(Status, "Pass"), "GOOD", null())