Here's an updated version to be as close as possible to OP's requirements:   | makeresults count=4 | streamstats count | eval age = case(count=1, 12, count=2, 25, count=3, 65, count=4, 21) | eval city = case(count=1, "Paris", count=2, "Berlin",count=3, "Tokyo", count=4, "Madrid") | eval name = case(count=1, "age", count=2, null(),count=3, "city", count=4, null()) | fields - _time count | foreach * [| eval fieldnames=mvappend(fieldnames,"<<FIELD>>") | eval fieldvalues=mvappend(fieldvalues,<<FIELD>>) | eval value=mvindex(fieldvalues,mvfind(fieldnames,name)) ] | fields - fieldnames fieldvalues       ... View more

Hi takao, For your information, there is an updated version which was released last month, with updated jQuery, but I am not sure which version they ship: Splunk Add-on for Microsoft Office 365 Reporting Web Service | Splunkbase ... View more

Hi @mseijos, I stumbled accross the same problem and think I got a solution, based on previous contribs:   | makeresults count=10 | fields - _time | streamstats count | eval dummyName1="dummyVal1",dummyName2="dummyVal2", name="count", dummyName3="dummyVal3",dummyName4="dummyVal4" | foreach * [| eval fieldnames=mvappend(fieldnames,"<<FIELD>>") | eval fieldvalues=mvappend(fieldvalues,<<FIELD>>) | eval value=mvindex(fieldvalues,mvfind(fieldnames,name)) ] | fields - dummy* fieldnames fieldvalues | table count name value     I added dummy values to test the code, as simpler solutions weren't working with a lot of fields per log (because foreach parses all values) I know it's surely too late for you, but maybe some others will find this interesting.   ... View more