https://community.splunk.com/t5/Splunk-Search/Log-Metrics-and-use-on-dashboard/m-p/685601#M233935 <P>I have a case where the we have some associated metric for each request/response event , something like below:</P> <LI-CODE lang="markup">{ "Key1" : "val", "Array12" : [ "val1", "val2" ], "NewList" : [ { "K1":"v11", "K2":"v12", "K3":"v13" }, { "K1":"v21", "K2":"v22", "K3":"v23" } ] }</LI-CODE> <P><BR />Now this list ,&nbsp;NewList is too big and having key-val pairs is making the log very bulky.</P> <P>Is there any way to make it consize and they be able to read this in a dashboard as below</P> <P>K1 , K2 , K3<BR />V11,V12,V13<BR />V21,V22,V23</P> Fri, 26 Apr 2024 12:11:07 GMT nehasha3 2024-04-26T12:11:07Z https://community.splunk.com/t5/Splunk-Search/Log-Metrics-and-use-on-dashboard/m-p/685601#M233935 <P>I have a case where the we have some associated metric for each request/response event , something like below:</P> <LI-CODE lang="markup">{ "Key1" : "val", "Array12" : [ "val1", "val2" ], "NewList" : [ { "K1":"v11", "K2":"v12", "K3":"v13" }, { "K1":"v21", "K2":"v22", "K3":"v23" } ] }</LI-CODE> <P><BR />Now this list ,&nbsp;NewList is too big and having key-val pairs is making the log very bulky.</P> <P>Is there any way to make it consize and they be able to read this in a dashboard as below</P> <P>K1 , K2 , K3<BR />V11,V12,V13<BR />V21,V22,V23</P> Fri, 26 Apr 2024 12:11:07 GMT https://community.splunk.com/t5/Splunk-Search/Log-Metrics-and-use-on-dashboard/m-p/685601#M233935 nehasha3 2024-04-26T12:11:07Z https://community.splunk.com/t5/Splunk-Search/Log-Metrics-and-use-on-dashboard/m-p/685603#M233936 <P>Do you mean something like this?</P><LI-CODE lang="markup">| spath NewList{} output=NewList | table NewList | mvexpand NewList | spath input=NewList | fields - NewList</LI-CODE> Fri, 26 Apr 2024 09:59:43 GMT https://community.splunk.com/t5/Splunk-Search/Log-Metrics-and-use-on-dashboard/m-p/685603#M233936 ITWhisperer 2024-04-26T09:59:43Z