You should not use foreach *. tag::event is a meta field and foreach will not handle those. It is quite obvious that your data also contain other irrelevant fields. If you know those tag names, en...
See more...
You should not use foreach *. tag::event is a meta field and foreach will not handle those. It is quite obvious that your data also contain other irrelevant fields. If you know those tag names, enumerate it. (Read the document.) | foreach flag1 flag2 flag3 ... flagX
[eval trueflag = mvappend(trueflag, if(<<FIELD>> == "true", "<<FIELD>>", null()))]
| stats count by trueflag Alternatively, you probably do not care about other fields. Remove them so foreach will not be bombed. | fields loggingObject.responseJson
| spath input=loggingObject.responseJson
| foreach *
[eval trueflag = mvappend(trueflag, if(<<FIELD>> == "true", "<<FIELD>>", null()))]
| stats count by trueflag