How to extract field names from an object or nested JSON field?

[SwervyMcBourbon]

For these following two events:

{
  "people": {
    "bob": 172,
    "maria": 161
  }
}

{
  "people": {
    "bob": 172,
    "garth": 180
  }
}

 
I want to report the number of occurrences of each person's name in the "people" object (the field name itself, not its value).  The desired result of my query against the two events above would be:

bob: 2
maria: 1
garth: 1

What SPL syntax/commands could I use to achieve this?  I have tried a variety of things online to no avail.

[SwervyMcBourbon]

This worked like a charm, thank you @richgalloway !

[richgalloway · Accepted solution]

See if this helps.

<<your search for people events>>
| spath
```Loop over the people object and make a list of each name found```
| foreach people.* [ eval name=mvappend(name,if(isnotnull('<<FIELD>>'),"<<MATCHSTR>>", null()))]
```Break the name list into separate events```
| mvexpand name
```Count the names```
| stats count by name