Assuming the Windows TA extracts Account Name into a multi-valued field. On my test machine, I have a field called Account_Name that has been extracted for both of these values. Use the mvindex() function to reference a specific value in a multivalue field. Since the index numbering starts at 0 you will use the following two eval statements. |eval Server_Account = mvindex(Account_Name,0) |eval User_Account = mvindex(Account_Name,1) ... View more