Think that rawKeys have "aaa,bbb,ccc". the solution: ... | eval keys=split(rawKeys,",") | eval countKeys=mvcount(keys) | mvexpand keys | map search=" search | head 1 | eval key=\"$keys$\" | eval rawKeys=\"$rawKeys$,\" | eval countKeys=\"$countKeys$\" | rex field=rawKeys \"$keys$(?.*)\" | eval positionKey=(countKeys-(mvcount(split(endBlock,\",\"))-1) ) " ... in the end result "aaa" positionKey = 0, "bbb" positionKey = 1 and "ccc" positionKey = 2. ... View more