You can do search time field extractions pretty easy since all the fields are comma separated. Go to settings --> Fields -->Field transformations. Follow below steps. . ... View more

There are several ways. The following is the preferable, stats version, that has no limitations. (index="docverificationengine" "Issuing country does not match WR records for Sender") OR (index="senderverification" Verification "DocumentType\\\":2" ) | rex field=_raw "records for Sender \[(?P<senderId>[^\]]+)\]" | rex field=_raw "queue: {\\\\\"SenderId\\\\\":(?<senderId>\d+)," | fields index senderId | stats dc(index) as foundboth by senderId | where foundboth==2 CORRECTION - This method would only work if the field SenderId was an extracted field, which is apparently not the case. Since you only are looking for items in the second search that are also in the first search, you could use a subsearch. In this case, either half could be put in braces as a subsearch to limit the other one's main search... index="senderverification" Verification "DocumentType\\\":2" [index="docverificationengine" "Issuing country does not match WR records for Sender" | rex field=_raw "records for Sender \[(?P<senderId>[^\]]+)\]" ' | table senderId] | rex field=_raw "queue: {\\\\\"SenderId\\\\\":(?<senderId>\d+)," | table senderId The above method can be used as long as the number of results will not exceed a few hundred results. Everything in braces will be returned to the outside search as ( ( senderId="value1" ) OR ( senderId="value2" ) ...) ... which will not work, since the field is not automatically search-time extracted. You could reformat the output to use it, but the alternate, stats version is preferable anyway, so this is left here as documentation only for anyone with similar issues where the field IS extracted. ... View more

@Shashank_87 Can you please try the following search? Note: Here, I have assumed the Event field contains the combinations. YOUR_SEARCH | eval Event=mvsort(Event) | eval Event=mvjoin(Event,",") | top Event | eval Event=split(Event,",") My Sample Search: | makeresults | eval Event="A,B,C,D|B,C,D,E|A,B,C,D|B,C,D,E|X,Y,Z|B,A,C,D" | eval Event=split(Event,"|") | mvexpand Event | eval Event=split(Event,",") | table Event | eval Event=mvsort(Event) | eval Event=mvjoin(Event,",") | top Event | eval Event=split(Event,",") Here I have managed multivalue with the different order. If you don't want it then remove | eval Event=mvsort(Event) from search. Thanks ... View more