You may try "Your current search" |eventstats max(eval(if(action=="B",count,null()))) as action_b by feature,version |eval difference=action_b - count   Run anywhere example | makeresults |eval action="A A A B A A B"|makemv action|mvexpand action |appendcols[|makeresults |eval feature="f1 f1 f1 f1 f1 f1 f1"|makemv feature| mvexpand feature] |appendcols[|makeresults |eval version="v1 v1 v1 v1 v2 v2 v2"|makemv version| mvexpand version] |appendcols[|makeresults |eval location="WA OR CA AZ WA OR AZ"|makemv location| mvexpand location] |appendcols[|makeresults |eval count="120 110 115 120 14 10 15"|makemv count| mvexpand count] |fields - _time |rename COMMENT as "Ignore above data similution search" |eventstats max(eval(if(action=="B",count,null()))) as action_b by feature,version |eval difference=action_b - count |fields action,feature,version,location,count,difference   ... View more