A colleague eventually came up with the following query that does exactly what I wanted: | inputlookup CUCM_lboro_assigned_numbers_27_6_22.csv
| rename DN AS phone
| search NOT
[ search index=cucm cdrRecordType=1 duration>0
| eval phone = mvappend(callingPartyNumber,originalCalledPartyNumber,finalCalledPartyNumber)
| mvexpand phone
| dedup phone
| table phone
] As you can see, it's still creating a multi-field value out of the fields I'm interested in (callingPartyNumber, originalCalledPartyNumber and finalCalledPartyNumber), but the using mvexpand to create a new event for each field and, most importantly, then dedupe'ing those events
... View more