Thankyou for your help. i try your sample case . but it does not meet my request. In my request, 45, 46, and 48 must appear strictly in this order . I have added some content based on yours.  pls help me .   index=_internal | head 10 | fields _time _raw | reverse | streamstats count | eval _raw="user=".if(count=8,"B","A")." eventid=".mvindex(split("45.46.48.45.48.48.46.48.45.46","."),count -1 ) | fields -count | kv | rename COMMENT as "this is sample" | transaction user maxevents=3       ... View more

hello conditions are: if user=A, and The eventid values of the three events are 45, 46 and 48 in sequence，then group this three event。 ... View more

hello conditions are: if user=A, and The eventid values of the three events are 45, 46 and 48 in sequence，then group this three event。 ... View more