| makeresults | eval _raw="Index Field1 Field2 1 0 A,B,C 1 -5 D,E,F 1 -10 G,H,I" | multikv | stats values(Field1) as Field1 values(Field2) as Field2 by Index `comment("Up to this point is the creation of dummy data.")` `comment("Create Table")` | mvexpand Field2 | mvexpand Field1 | sort - Field1 | streamstats dc(Field1) as count | eval table_tmp=Field1."#".Field2 | stats values(table_tmp) as table_tmp values(Index) as Index by count | eval table_data=mvindex(table_tmp,count-1) | rex field=table_data "(?<Field1>[^#]+)#(?<Field2>[^#]+)" | fields Index Field1 Field2 Hi, It's strange when it comes from dummy data. ... View more