@NS Try this, YOUR_SEARCH
|eval Result = case(Column1="Apple" OR Column2="Grape" OR Column3="Cherry", "Fruits", Column1="Spinach" OR Column2="Potato" OR Column3="Raddish" , "Vegetables",1==1, "Unknown") Sample Search: | makeresults | eval _raw="
Column1 Column2 Column3
Apple Grape Cherry
Spinach Potato Raddish"
| multikv forceheader=1
|eval Result = case(Column1="Apple" OR Column2="Grape" OR Column3="Cherry", "Fruits", Column1="Spinach" OR Column2="Potato" OR Column3="Raddish" , "Vegetables",1==1, "Unknown")
... View more