thanks! this was the basis for my solution. the multivalue field result will contain a yes if any of that event's fields is a match.
| makeresults | eval name5="son" | eval firstname="personA"
| append [| makeresults | eval name5="sonA" | eval lastname="personA"]
| append [| makeresults | eval name5="sonA" | eval firstname="personB"]
| append [| makeresults | eval name5="per" | eval anyfieldname="personA"]
| eval result=""
| foreach *name
[ eval result=if(like('<<FIELD>>',"%".name5."%"),result + " yes", result + " no") ]
| makemv result |search result=yes
... View more