Thank you for reposting data as plain text and not emojis . Let this be a lesson for everyone using this board: make use of the text block (that </> button in editor) and you can avoid mishaps. An...
See more...
Thank you for reposting data as plain text and not emojis . Let this be a lesson for everyone using this board: make use of the text block (that </> button in editor) and you can avoid mishaps. Another good practice is to use Splunk's autoformat function in search window. Anyway, the logic behind | spath | eval message="{\"message\":".message."}" escapes me, because first, without any prompt, Splunk should have given you a whole number of multi-valued fields such as {}.TARGETSYSTEM and {}.ARUNAME. Adding another spath only doubles their entry. Second, I do not see any field name message. Are your event illustrations of _raw events or of a particular field named message that has been extracted by Splunk? If it is the latter, there is no reason why your search wouldn't give the desired results. Here is an emulation of "message" field in your illustrations: | makeresults
| eval message=mvappend("[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":6,\"FAILED\":6,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":7295,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":273,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":23,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00303\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":22,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01015\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":38,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":44,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":6,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":7177,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":116,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":37,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":215,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00061\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":14,\"FAILED\":14,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":21,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":546,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":801,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":150,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":69,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":542,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":335,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":10,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":12,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":637,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":2,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":88,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":24,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5}]",
"[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00797H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":511,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":210,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":21,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4}]")
| mvexpand message
``` the above emulates the "message" field from
index = ***** host=**** source=***
``` Apply your search (skip that first spath) with Splunk autoformat | eval message="{\"message\":".message."}"
| spath input=message message{} output=collection
| mvexpand collection
| spath input=collection
| eval totalCount = SKIPPED + PROCESSED
| chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE I get this table: DAYHOUR Processed: 7/9/2024 SKIPPED: 7/9/2024 TotalClaims: 7/9/2024 4 218 536 754 5 16644 1862 18506 If the two illustrations are for raw events, emulation is like the following: | makeresults
| eval data=mvappend("[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":6,\"FAILED\":6,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":7295,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":273,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":23,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00303\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":22,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01015\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":38,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":44,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":6,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":0,\"PROCESSED\":7177,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":116,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":37,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":215,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00061\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":14,\"FAILED\":14,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":21,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":546,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00030\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":801,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":150,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":69,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":542,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":335,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00473H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":10,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":12,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":637,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":2,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":88,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00086\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079MEDICA\",\"TOTAL\":0,\"PROCESSED\":24,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00022AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":5}]",
"[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00797H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":511,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":210,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00396\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":21,\"PROCESSING\":0,\"DATE\":\"7/9/2024\",\"DAYHOUR\":4}]")
| mvexpand data
| rename data as _raw
| spath
``` the above emulates
index = ***** host=**** source=***
``` Use a slightly modified search from your original, | fields - {}.* ``` opitional - just to clear view during development ```
| spath path={} ``` you can directly use {} as fieldname, no need to append ```
| mvexpand {}
| fields - _*
| spath input={}
| eval totalCount = SKIPPED + PROCESSED
| chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE This gives the exact same result. Could you clarify?