New comment on reddit

Didn't know these were multivalue fields in the event itself

In that case, do this:

index=ndx sourcetype=srctp SRC_FILE_NM_TXT=* STATUS_TXT=* | eval attach=mvzip(SRC_FILE_NM_TXT,STATUS_TXT,"|") | mvexpand attach | where match(attach,"\|.+omplete") | stats count by attach as "Complete Files" | rex field=attach "(?<file_name>.+)\|" | fields - attach 

I end up doing this with multivalue fields from ForeScout all the time