This should work. We are doing a foreach on the field_name to match against the fields listed in "sli_dimensions_alert", and a true match will result in the field_value being appended to new variable "alert_values".   | makeresults | eval env="PRD", service_name="EXGMGR", type="LOBREQUEST", class="TIMEOUTERROR", lob="GOV", product="APPLE", resource="SERVER" | eval sli_dimensions_alert="env,service_name,type,class" | eval sli_dimensions_alert="env,service_name,type,class,product,resource,lob" | eval alert_fields=SPLIT(sli_dimensions_alert, ",") | foreach env service_name type class product resource lob [| eval field_name="<<FIELD>>" | eval alert_values=IF(field_name=alert_fields, MVAPPEND(alert_values, <<FIELD>>), alert_values)] | eval alert_name=MVJOIN(alert_values, "-")   ... View more