Based on the solution posted by @ITWhisperer , here is the final approach I am using: | makeresults
| eval host="server42"
| eval location="dallas"
| eval temp="50"
| eval color="blue"
| eval fieldList="host,, temp color"
| rex mode=sed field=fieldList "s/\s+/,/g"
| eval mvfieldList=split(fieldList, ",")
| foreach * [ eval value=if(in("<<FIELD>>",mvfieldList), mvappend(value,<<FIELD>>), value) ]
| eval concatenated=mvjoin(value," - ") This loads the values into 'concatenated' in alphabetical fieldname order (from 'fieldList'), rather than in the order listed in 'fieldList', but this is OK for my use case (since it will be consistent). Thanks to @ITWhisperer and @renjith_nair for responding!
... View more