https://community.splunk.com/t5/Getting-Data-In/Json-data-processing/m-p/562617#M100263 Thank you so much for your advice! I will try according to your suggestion in the near future. Mon, 09 Aug 2021 14:42:31 GMT xuehpx 2021-08-09T14:42:31Z https://community.splunk.com/t5/Getting-Data-In/Json-data-processing/m-p/562339#M100174 <P><SPAN>I have a json format of data, I can not use the following method to process the results I want, when metricValue is a new dictionary, I changed how to extract.</SPAN></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="xuehpx_0-1628213089777.png" style="width: 603px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15449iB7464EBA5ABD5F83/image-dimensions/603x189?v=v2" width="603" height="189" role="button" title="xuehpx_0-1628213089777.png" alt="xuehpx_0-1628213089777.png" /></span></P><P>index="huawei_fc" sourcetype="BW_HWFC:metric:host" | rename value{}.* as * | eval t = mvzip(metricId,metricValue) | mvexpand t | eval mId=mvindex(split(t,","),0),mValue=mvindex(split(t,","),1) | stats values(mValue) as mValue by _time,urn,mId</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="xuehpx_1-1628213321615.png" style="width: 605px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15450i16996614661E04B8/image-dimensions/605x43?v=v2" width="605" height="43" role="button" title="xuehpx_1-1628213321615.png" alt="xuehpx_1-1628213321615.png" /></span></P><P><SPAN>I was unable to extract the data in metricValue from the SPL above</SPAN></P><P><SPAN>&nbsp;</SPAN></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 06 Aug 2021 01:32:10 GMT https://community.splunk.com/t5/Getting-Data-In/Json-data-processing/m-p/562339#M100174 xuehpx 2021-08-06T01:32:10Z https://community.splunk.com/t5/Getting-Data-In/Json-data-processing/m-p/562383#M100178 <P>Try a different delimiter in mvzip and split</P><LI-CODE lang="markup">| eval t = mvzip(metricId,metricValue,"|") | mvexpand t | eval mId=mvindex(split(t,"|"),0),mValue=mvindex(split(t,"|"),1)</LI-CODE> Fri, 06 Aug 2021 07:54:54 GMT https://community.splunk.com/t5/Getting-Data-In/Json-data-processing/m-p/562383#M100178 ITWhisperer 2021-08-06T07:54:54Z https://community.splunk.com/t5/Getting-Data-In/Json-data-processing/m-p/562617#M100263 Thank you so much for your advice! I will try according to your suggestion in the near future. Mon, 09 Aug 2021 14:42:31 GMT https://community.splunk.com/t5/Getting-Data-In/Json-data-processing/m-p/562617#M100263 xuehpx 2021-08-09T14:42:31Z