I do not have the ability to search _indexes, so I adapted your solution to my makeresults method like this: | makeresults
| eval test="Linked to Historical Cyber Exploit,1;Historically Linked to Malware,1;Historically Linked to Penetration Testing Tools,1;Exploited in the Wild by Recently Active Malware,5"
| eval test2="Linked to Historical Cyber Exploit,1;Historically Linked to Malware,2;Historically Linked to Penetration Testing Tools,1;Exploited in the Wild by Recently Active Malware,4"
| eval test3= "Linked to Historical Cyber Exploit,1;Historically Linked to Malware,4;Historically Linked to Penetration Testing Tools,1;Exploited in the Wild by Recently Active Malware,4"
| eval test4="Linked to Historical Cyber Exploit,2;Historically Linked to Malware,2;Historically Linked to Penetration Testing Tools,2"
| table test*
| transpose
| table "row 1"
| rename "row 1" as data
| makemv delim=";" data
| mvexpand data
| rename data as _raw
| rename COMMENT as "this is sample. from here, the logic."
| rex "(?<num>\d+$)"
| eventstats max(num) as max_num
| stats values(eval(if(like(_raw,"%".max_num),_raw,NULL))) as result This solution identifies one field with the highest value, but does not return the value for each field. I should have updated my desired results, because my original description is incomplete. The results I would like to get from this dataset would look similar to this: The problem I am facing now is the proposed solutions to recreate the multivalue field use stats which drops the other fields in my data that I didn't include in the example.
... View more