I came across this post while trying to figure out how to solve the same issue, and I think I've worked it out: | eval old_role_name = mvindex('modifiedProperties{}.oldValue', mvfind('modifiedProperties{}.displayName', "Role\.DisplayName")) modifiedProperties{}.oldValue and modifiedProperties{}.displayName are both multivalue fields.  I found the mv index number of modifiedProperties{}.displayName where the value is Role.DisplayName using mvfind, then used that index number to extract the correct value from modifiedProperties{}.oldValue  into a new field with mvindex. (The backslash in the second argument of mvfind is because it's actually a regex, not a vanilla string). ... View more