Hi @deephi ...  The most Linux systems should be compatible with Splunk Agent(Splunk "Universal Forwarder") (Linux, all 3.x and 4.x kernel versions x86 (64-bit),  Linux, 5.x kernel versions 5.4 and higher x86 (64-bit)) https://docs.splunk.com/Documentation/Splunk/9.1.1/Installation/Systemrequirements   Red Hat Enterprise Linux 8.0 is distributed with the kernel version 4.18. 0-80.. So well within the support limit. thanks. 

Hi @DaveBunn, I wrote the Word Tree Viz and as cool as it is... I don't think it will give you what you need in this case. However, you may be interested in the Treeview Viz. Here's some SPL to create a treeview representation of the hierarchy: |makeresults | eval raw = "Name=\"Dave Bunn \", OrgPosition=\"12345_Dave_Bunn \",Manager=\"1230_Mrs_Bunn\",MiscDetails=\"some text about my job\"@@@ Name=\"Mrs Bunn\",OrgPosition=\"1230_Mrs_Bunn\",Manager=\"10_The_Big_Boss\",MiscDetails=\"some text about Mrs Bunns job\"@@@ Name=\"Big Boss\",OrgPosition=\"10_The_Big_Boss\",Manager=\"0_The_Director\",MiscDetails=\"Manager of HR\"" | makemv raw delim="@@@" | mvexpand raw | rename raw as _raw | fields _raw | extract | fields - _time, _raw ``` Above: Creating the test data ``` | rename OrgPosition as id, Manager as parentid, Name as label ``` This bit is to fix any managers that don't appear in the data - i.e. 0_The_Director``` | appendpipe[|stats count by parentid| eval label=parentid, id=parentid | table label, id] ``` Reverse so the appendpipe appears first for the visualisation``` | reverse | eval iconDoc="user-circle", iconFolderOpen="users" | eval color=if(label="Dave Bunn","#DC4E41",null())   And here's what it looks like: Alternatively, you could use the Network Diagram Viz: SPL looks like this: |makeresults | eval raw = "Name=\"Dave Bunn \", OrgPosition=\"12345_Dave_Bunn \",Manager=\"1230_Mrs_Bunn\",MiscDetails=\"some text about my job\"@@@ Name=\"Mrs Bunn\",OrgPosition=\"1230_Mrs_Bunn\",Manager=\"10_The_Big_Boss\",MiscDetails=\"some text about Mrs Bunns job\"@@@ Name=\"Big Boss\",OrgPosition=\"10_The_Big_Boss\",Manager=\"0_The_Director\",MiscDetails=\"Manager of HR\"" | makemv raw delim="@@@" | mvexpand raw | rename raw as _raw | fields _raw | extract | fields - _time, _raw ``` Above: Creating the test data ``` | appendpipe[| stats count by Manager | eval type="user", nodeText=Manager, from=Manager | table from, nodeText, type] | appendpipe[| stats count by Name, OrgPosition | eval type="user", from=OrgPosition, nodeText=Name | table from, nodeText, type] | appendpipe[| stats count by OrgPosition, Manager | eval from=Manager, to=OrgPosition | table from, to] | eval color=if(nodeText="Dave Bunn","red",null()) | table from, to, nodeText, color, type | search from=*   When choosing a hierarchal view, that gives you this:  It will look a bit more impressive when there are more people and roles listed.   Hopefully those two visualisations give you something to work from.   Cheers, Daniel    

Hi @Thulasiraman , Here's one way to create a table using some of Splunk's built-in JSON commands. |makeresults | eval json="{ \"Group10\": { \"owner\": \"Abishek Kasetty\", \"fail\": 2, \"total\": 12, \"agile_team\": \"Punchout_ReRun\", \"test\": \"\", \"pass\": 6, \"report\": \"\", \"executed_on\": \"Mon Oct 23 03:10:48 EDT 2023\", \"skip\": 0, \"si_no\": \"10\" }, \"Group09\": { \"owner\": \"Lavanya Kavuru\", \"fail\": 45, \"total\": 190, \"agile_team\": \"Hawks_ReRun\", \"test\": \"\", \"pass\": 42, \"report\": \"\", \"executed_on\": \"Sun Oct 22 02:57:43 EDT 2023\", \"skip\": 0, \"si_no\": \"09\" }}" ``` Above is just to create the test data``` | eval keys = json_keys(json) | eval keys = json_array_to_mv(keys) | mvexpand keys | eval group = json_extract(json, keys) | fields - _time, json | spath input=group ``` Table out the fields you're interested in ``` | table agile_team, pass, fail   The search is doing the following: Get all the "GroupXX" keys (assuming these change each time you run the search) Convert the Group keys to a multivalue field MVExpand the keys so there's one per event Pull out each Group's values using the key Run spath to convert the JSON to fields Table out what you need   The output looks like this: Cheers, Daniel