hi @soundv
try this ..if you want sum
|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,7.10" | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2
| eventstats sum(IMSI1) as sum_IMSI1,sum(IMSI2) as sum_IMSI2 |eval diff=sum_IMSI1-sum_IMSI2
Or count od IMSIs try this
|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,3" | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2
| eventstats count(IMSI1) as count_IMSI1,count(IMSI2) as count_IMSI2 |eval diff=count_IMSI1-count_IMSI2
... View more