One way using stats, which will be efficient | makeresults | eval new_set="A,B,C" | makemv delim="," new_set | append [| makeresults | eval baseline="X,Y,Z" ] | makemv delim="," baseline ``` Join rows together ``` | stats values(*) as * ``` Expand out the baseline data ``` | stats values(*) as * by baseline ``` Collect combinations ``` | eval combinations=mvmap(new_set, new_set. "-". baseline) ``` and combine again ``` | stats values(combinations) as combinations It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.   ... View more

Also noticing there is a problem in the props.conf with assigning the dest attribute in order to properly assign hostname values for use with the Malware Data Model in ES. If dhost has a value and shost doesn't, the logic in the original props.conf appears to overwrite dest with shost which is null. Added the following to local/props.conf which appears to have resolved it and left the default/props.conf alone. Perhaps this could be incorporated in the next release as well. Thanks [trendmicro] EVAL-dest = case((isnotnull(shost) AND isnull(dhost)),shost,(isnull(shost) AND isnotnull(dhost)),dhost) ... View more