You can use spath then foreach to make the attribute/name values to their respective fields. Note your original XML is malformed - you are missing "/" character on closing OrderAttributeValue and you have an extra > after your OrderRef. | makeresults
| eval _raw="<RECORD>
<ORDER>
<OrderDate>21-11-2022</OrderDate>
<OrderRef>12345678</OrderRef>
<OrderAttributes>
<OrderAttributeName>Attribute1</OrderAttributeName>
<OrderAttributeValue>Value1</OrderAttributeValue>
<OrderAttributeName>Attribute2</OrderAttributeName>
<OrderAttributeValue>Value2</OrderAttributeValue>
<OrderAttributeName>Attribute3</OrderAttributeName>
<OrderAttributeValue>Value3</OrderAttributeValue>
</OrderAttributes>
</ORDER>
</RECORD>"
| spath
| rename RECORD.ORDER.* as *
| foreach 0 1 2 3 4 [ eval f=mvindex('OrderAttributes.OrderAttributeName', <<FIELD>>), {f}=mvindex('OrderAttributes.OrderAttributeValue', <<FIELD>>) ]
| table OrderDate OrderRef Attribute* The numbers in the foreach will determine how many possible attributes this can handle
... View more