In my event data, I have a field called "blocks", the content of that field is a comma separated list of blocks. For example: block_1,block_4,block_10 block_1,block_3,block_4 I want to be able to count the occurrence of the blocks over time. So from above example, I should get the following block_1 2 block_3 1 block_4 2 block_10 1 I have this working via the following, however it is very slow. <my search> | makemv delim="," blocks| mvexpand blocks| stats count by blocks Is there a more efficient way to do this? ... View more