Try this method.
This replicates your data
| makeresults
| eval data="foo;123,123,123:bar;123,456,789,789"
| makemv data delim=":"
| mvexpand data
| makemv data delim=";"
| eval id=mvindex(data,0), abc=mvindex(data,1)
| makemv abc delim=","
| table id, abc
This gets the results you're looking for. if you already have the data in separate events, only the last two lines are needed.
| makeresults
| eval data="foo;123,123,123:bar;123,456,789,789"
| makemv data delim=":"
| mvexpand data
| makemv data delim=";"
| eval id=mvindex(data,0), abc=mvindex(data,1)
| makemv abc delim=","
| stats count(eval(mvcount(abc))) as count by id, abc
... View more