Okay, Think I figured out a way forward. I'm using rex to parse out every other item directly from the sistats generated field:
| eval parsed_sites=psrsvd_vm_site | rex field=parsed_sites mode=sed "s/(\d+);\d+;?/\1;/g"
| eval parsed_counts=psrsvd_vm_site | rex field=parsed_counts mode=sed "s/\d+;(\d+);?/\1;/g"
This gives me two fields holding each type of value in order. Now I should be able to manipulate those lists to get what I want. Probably by converting them to multivalued fields, getting the index of a site and looking up the count by index, etc.
... View more