You might have some success by using eval to create "proxy" fields for your original data. I've used this technique in the past similar to this:
my_search
| eval field1=if(match(_raw,"ABC"),1,0)
| eval field2=if(match(some_other_field,"XYZ"),1,0)
| chart sum(field1) as ABC_COUNT, sum (field2) as XYZ_in_some_other_field_count
Basically, you would eval a field to a "0" or a "1" for each of your 9 possible values above. Then when you sum() the value of these new fields, you have a count of events that matched each criteria.
... View more