I am working with some email header data, starting with generating some multi-value fields and now get to this point... index=teed sourcetype="emaildata" | eval max_date_sent= max(DateTimeSent) | dedup message_id, max_date_sent |table FromEmailAddress, Subject, DateTimeSent, ToRecipient, CcRecipient, BccRecipient | where FromEmailAddress != "" but what I really want is to examine the individual relationship, so the final output will like this... I've tried this index=cms sourcetype="exchangeemails" | eval max_date_sent= max(DateTimeSent) | dedup InternetMessageID, max_date_sent | eval tocc=mvzip(ToRecipients,CcRecipients) | eval receivers=mvzip(tocc,CcRecipients) | mvexpand receivers | makemv delim="," receivers | table FromEmailAddress, receivers but this returns some duplicated records for the receivers, and cannot distinguish if the receiver was originally a to/cc/bcc. Can someone point direction? Thanks! ... View more