I am assuming that when you say F4 in F5 is about the list of values of the split multi value field. See this example. You can see that split will split the second row values indicating that there is 'nothing' in the F2/F3 place, but as you can see from the count, there are 7 values in each row for the 'split' field. | makeresults
| eval f=split("F0,F1,F2,F3,F4,F5,F6:F0,F1,,,F4,F5,F6",":")
| mvexpand f
| table f
| eval split=split(f,",")
| eval count_of_split_results=mvcount(split)
| eval x=mvmap(split,if(len(split)=0,"-",split)) Note that is uses mvmap, which is a Splunk 8 function. But this simple iterates through the mv field values and changes any length 0 field to a hypen.
... View more