A lifesaver! Thank you! ... View more

Hi kumagaur, based on the provided examples this will work: | makeresults | eval TeamMember="A1 A2 A3 A4 A5 A6 A7" | makemv TeamMember | mvexpand TeamMember | eval Team = if((TeamMember="A1" OR TeamMember="A2") AND TeamMember="A4" AND TeamMember="A7", "foo" , "nope") But, also based on your provided information this eval will never match anything because TeamMember has never at the same time either A1 or B2 and A4 and A7 . I would review either the use case or the events, because this based on the provided information will never work. Hope this helps ... cheers, MuS ... View more

Actually my last subsearch is mandate filter which I can't make it as a first query 😞 and making the rows to column wont allow me to join it on a common field basis (eg; cn). Is it possible to get the output without subsearch? ... View more