It would help to see the rest of the event to know what fields are available to create a mvlist. What I have done, similar to what you are wanting to do, is broken out the entire event into 5 or 6 fields, then group them by the field that is common to that transaction... Such as ip_address. This is much easier when you setup a transactiontypes.conf for the transaction you are looking to create.
Example of transaction from transactiontypes.conf:
[event_collection]
fields = ip_address
startswith ="Login"
endswith ="Submit"
mvlist = event_type, event_timestamp, ip_address, user_id
Hope this helps!
... View more