Here is my code: index=example sourcetype=wineventlog computer_name="example" | transaction computer_name startswith="event_id=4732" endswith="event_id=4733" maxspan=15m mvraw=true mvlist=true | table _time, user.name, computer_name, event_id, _raw  I am trying to separate each event that occurs in order to get rid of fluff content such as "A security-enabled local group membership was enumerated." appearing hundreds of times. What would be the best way to do this? mvexpand has not worked for me so far. ... View more