Adapting the solution provided by @ITWhisperer to provide Desired Outcome 1. | makeresults | eval _raw="product color product_id description1 description2 description3 description4 phone blue tag_1 pass pass fail phone blue tag_2 fail pass pass fail" | multikv forceheader=1 | fields - _* linecount | eval pKey=product.":".color.":".product_id | fields - product color product_id | transpose 0 | eval same=if('row 1'=='row 2',"same","different") | where same="different" | fields - same | transpose 0 header_field=column | rex field=pKey "^(?<product>.*):(?<color>.*):(?<product_id>.*)" | fields - column pKey ... View more

Its worked, great that learned mvmap and mvfind today, thanks alot ... View more

@yuming1127  Can you please try this? With your provided sample data this will work. YOUR_SEARCH | fields product description1 description2 weight_a weight_b weight_c | eval description=mvappend("description1=".description1,"description2=".description2) | eval weight=mvappend("weight_a=".weight_a,"weight_b=".weight_b,"weight_c=".weight_c) | table product description weight   My Sample Search : | makeresults | eval _raw="product description1 description2 weight_a weight_b weight_c product_a string_a string_b number_a number_b number_c product_b string_c string_d number_d number_e number_f product_c string_e string_f number_g number_h number_i"| multikv forceheader=1 | fields product description1 description2 weight_a weight_b weight_c | eval description=mvappend("description1=".description1,"description2=".description2) | eval weight=mvappend("weight_a=".weight_a,"weight_b=".weight_b,"weight_c=".weight_c) | table product description weight   in case of multiple description and weight fields try this. YOUR_SEARCH | fields product description1 description2 weight_a weight_b weight_c | foreach description* [| eval description=mvappend(description,"<<FIELD>>="+'<<FIELD>>')] | foreach weight_* [| eval weight=mvappend(weight,"<<FIELD>>="+'<<FIELD>>')] | table product description weight   My Sample Search : | makeresults | eval _raw="product description1 description2 weight_a weight_b weight_c product_a string_a string_b number_a number_b number_c product_b string_c string_d number_d number_e number_f product_c string_e string_f number_g number_h number_i"| multikv forceheader=1 | fields product description1 description2 weight_a weight_b weight_c | foreach description* [| eval description=mvappend(description,"<<FIELD>>="+'<<FIELD>>')] | foreach weight_* [| eval weight=mvappend(weight,"<<FIELD>>="+'<<FIELD>>')] | table product description weight   Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

Great one thanks ... View more

@yuming1127  It would probably be possible to 'hide' the legend with CSS, if you know how to use CSS, then you should look at using the g.highcharts-legend-item element to disable the display for that field name prev_tag I am not sure how to do that, but perhaps open a new question and ask there.     ... View more

@yuming1127  For your search product_tag  scenario try this.  YOUR_SEARCH | eval a=1 , search_product_tag="YOUR_SEARCH_TAG" | accum a | eventstats max(eval(if(search_product_tag==product_tag,a,null()))) as mx | where a=mx OR a=mx-1 | table product color product_tag description   Sample Search: | makeresults | eval _raw="product color product_tag description phone red abc_1 blabla1 phone red abc_2 blabla2 phone red abc_3 blabla3 phone red abc_4 blabla4" | multikv forceheader=1 | table product color product_tag description | eval a=1 , search_product_tag="abc_3" | accum a | eventstats max(eval(if(search_product_tag==product_tag,a,null()))) as mx | where a=mx OR a=mx-1 | table product color product_tag description   Thanks KV ▄︻̷̿┻̿═━一 If this reply helps you, an upvote would be appreciated. ... View more

You have reduced your fields to just product_name and productID, so there is not tag_description field for the rex to work on. Perhaps, if you could share some anonymised events that you want to extract the fields from, we might be able to find a way to get what you want. ... View more

Get it, thanks for the quick reply and  great solution, really appreciate it. ... View more

ya, found a way to replace the null value with 0 and follow up with eval function, that worked too. Thanks! ... View more