By default splunk is extracting this fields off of your Json data, you can try this search...
index="index_name" sourcetype="sourcetype"
| rename "ns{}.ip_address" as ip_address, "ns{}.network_interfaces{}.port_name" as interfaces, "ns{}.instance_state" as instance_state
| stats count by instance_state,ip_address, interfaces
| stats values(instance_state) as instance_state,values(interfaces) as interfaces by ip_address
OR
index="index_name" sourcetype="sourcetype"
| spath
| rename "ns{}.ip_address" as ip_address, "ns{}.network_interfaces{}.port_name" as interfaces, "ns{}.instance_state" as instance_state
| stats count by instance_state,ip_address, interfaces
| stats values(instance_state) as instance_state,values(interfaces) as interfaces by ip_address
you can also add KV_MODE = json on your search-head props.conf
... View more