Hi yuanliu, Thank you for pointing out my mistakes in the regex and lack of clarity in my desired criteria. Your description of my intended output for results are correct. You are also correct that a multi-value field is not optimal for my desired results field. Thinking this over, I resolved the issue by using mvexpand on numbers before applying the Boolean logic (i.e. expression>5). I greatly appreciate your help to troubleshoot through both my SPL expressions and the implementation of the search. ... View more

Thank you for clearly pointing that out. I would appreciate further feedback about my query in my reply to yuanliu ... View more

Hello yuanliu, Thank you for pointing out the extra parentheses and lack of clarity in my search. Perhaps this adjusted search would help clarify further what I originally intended: | foreach mode=multivalue numbers [eval results=mvappend(results, if(tonumber(replace('<<ITEM>>', ",\d+", "")) > 5 AND tonumber(replace('<<ITEM>>', "^\d+,", "")) > 5, "true", "false"))]   While this adjusted search is now closer to what I intended, the results field only creates two outputs when I wanted to create three (one for each of the three values in the numbers field). The foreach command appears not to have reached the third value. Splunk_Hatched_0-1659028972380.png Splunk_Hatched_1-1659029019175.png   Further testing to check what '<<ITEM>>' actually returns appears to give a Null value (see the screenshot of testParseNumbers shown below). | eval testParseNumbers="" | foreach mode=multivalue numbers [eval results=mvappend(results, if(tonumber(replace('<<ITEM>>', ",\d+", "")) > 5 AND tonumber(replace('<<ITEM>>', "^\d+,", "")) > 5, "true", "false")), testParseNumbers=testParseNumbers.tostring('<<ITEM>>')]   Splunk_Hatched_2-1659030125605.png I would appreciate suggestions on how to fix this. Thank you. ... View more