something like below where Field A,count,B,C are multivalue existing  already calculated fields but additionally Field E and F are divided based on domain ( pre calculation we did in last query) but in domain signifying their unique combination values.       ... View more

after performing the query  base search | nomv FieldB | nomv FieldC| nomv FieldD | stats count values(*) as * by FieldA | foreach FieldB,FieldC FieldD [| eval <<FIELD>>=split(<<FIELD>>,"")] my result table is like below field A count Field c Field D Field E Field F abc.com 2 a b A B abc.com bcf.com def.com sub1 sub 2 sub 3 def.com 4 A B A B bcc.com xyz.com sub 5 sub 6 sub 6 efg.com 6 B A A  B jhg.com abc.com ghj.com sub 4 sub 7 sub 8   I want to  ask is their anyway/operation   that I can perform on field E and field F so that they are throwing unique combination value rather a multivalue filed.  Prior performing count operation in query Field E and F are unique but after count they become multi value which In later stage again I want to tke them to their prior state.  such that where field A,B,C,D remains same but Field E & F are divided further in rows on basis of unique combination of values of field E & F ( but parent unique combination of A,B,C,D remains same) ... View more

Thanks ! your provided answer worked. Additionally, explaining for others coming here. | nomv FieldB —- multivalue command to convert multivalued field to a single value field | nomv FieldC | nomv FieldD | stats count values(*) as * by FieldA —to get count of field values | foreach FieldB FieldC FieldD [| eval <<FIELD>>=split(<<FIELD>>," ")]. —- for every MV field converted to singlevalue field , converting them back to multivalue fields ... View more