https://community.splunk.com/t5/Splunk-Search/How-to-extract-info-from-nested-data-with-specific-parameter/m-p/593674#M206642 <P>Works perfectly, thank you!</P> Wed, 13 Apr 2022 19:23:01 GMT paulito 2022-04-13T19:23:01Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-info-from-nested-data-with-specific-parameter/m-p/593665#M206638 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Aternity Extraction.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19058i26DA2AC329BF646A/image-size/large?v=v2&amp;px=999" role="button" title="Aternity Extraction.png" alt="Aternity Extraction.png" /></span></P> <P>&nbsp;</P> <P>I need to extract the Activity Score and Application UXI Average but only when the Application Name is a certain name.&nbsp;</P> <P>It's a weird one for me because of the way data comes in. As you can see each event has multiple application names, activity scores, uxi averages and timeframes. So even when I specify for a certain app in a search, since the app name is in an event, I get the whole event which includes all the other apps and metrics.</P> <P>I hope what I'm explaining is clear and any help would be appreciated.&nbsp;</P> <P>&nbsp;</P> Wed, 13 Apr 2022 18:47:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-info-from-nested-data-with-specific-parameter/m-p/593665#M206638 paulito 2022-04-13T18:47:01Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-info-from-nested-data-with-specific-parameter/m-p/593669#M206640 <LI-CODE lang="markup">| spath value{} output=value | mvexpand value | spath input=value | where APPLICATION_NAME="certain app"</LI-CODE> Wed, 13 Apr 2022 18:45:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-info-from-nested-data-with-specific-parameter/m-p/593669#M206640 ITWhisperer 2022-04-13T18:45:30Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-info-from-nested-data-with-specific-parameter/m-p/593674#M206642 <P>Works perfectly, thank you!</P> Wed, 13 Apr 2022 19:23:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-info-from-nested-data-with-specific-parameter/m-p/593674#M206642 paulito 2022-04-13T19:23:01Z