Hi @thierry How about this? Ultimately I think you need to get it into a multival field so you can expand into indiviaual events: | foreach temperature humidity
[ eval contents=mvappend(c...
See more...
Hi @thierry How about this? Ultimately I think you need to get it into a multival field so you can expand into indiviaual events: | foreach temperature humidity
[ eval contents=mvappend(contents,json_set("{}","name","<<FIELD>>","value", <<FIELD>>))
]
|mvexpand contents
| eval contents=json_set(contents,"location",location)
| eval _raw=contents Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing