Try this (first two lines are just to generate some sample data, replace those with your actual search):
| makeresults
| eval file= "test1.txt , test2.txt , https://www.google.com";
| eval file = split(file,",")
| eval url = mvjoin(mvfilter(match(file,"^\s*http")),",")
| eval file = mvjoin(mvfilter(NOT match(file,"^\s*http")),",")
You might need to do some cleanup on spaces
And an alternative using rex to extract the urls into the url field and sed to clean up the file field:
| makeresults
| eval file= "http://try.me , test1.txt , http://test.nl , test2.txt , https://www.google.com";
| rex field=file max_match=0 "(?<url>http[^,\s]+)"
| eval url = mvjoin(url," , ")
| rex field=file mode=sed "s/ , http[^,\s]+( ,)?/\1/g"
| rex field=file mode=sed "s/^http[^,\s]+( , )?//g"
... View more