I want to get the last index of my target value for a multi-value field. For example, id chain 1 SendMessage CheckMessage PayForIt 2 CheckMessage SendMessage CheckMessage PayForIt 3 PayForIt SendMessage CheckMessage PayForIt 4 SendMessage PayForIt CheckMessage If "PayForIt" appears, meanwhile "SendMessage" and "CheckMessage" appears before it, this is a normal event. But if "SendMessage" or "CheckMessage" don't appear, or after "PayForIt", it is a abnormal event. It means you must send message and be verified by SMS before you pay for something! The id 1, 2 and 3 above are normal, 4 is abnormal. I've tried mvfind like below, but it will treat 2, 3 as abnormal event! eval send=mvfind(chain,"SendMessage")
| eval check=mvfind(chain,"CheckMessage")
| eval pay=mvfind(chain,"PayForIt")
| where isnotnull(pay) and isnotnull(check) and isnotnull(send) and pay>check and check>send
... View more