Hi, I would like to get help on applying stats on the following JSON data: { "ts":1527498793267, "version":"1.12.7", "data":{ "myList":[ { "id":"180528_090203", "nativeRequestReceived":1, "nativeResponseSent":1 }, { "id":"180528_090129", "nativeRequestReceived":1, "nativeResponseSent":1 } ], "freemem":6534152192 }, "time":"2018-05-28T09:13:13.267Z", "v":0 } I started writing the query as written below, but it doesn't give desired result. split function is grouping same values of nativeResponseSent and nativeRequestReceived together. input data | rename data.myList{}.* as * | eval mvfield=mvzip($id$,mvzip($nativeResponseSent$,$nativeRequestReceived$)) | fields mvfield | mvexpand mvfield | eval mvfield=split(mvfield,",") | eval id=mvindex(mvfield,0) | eval nativeResponseSent=mvindex(mvfield,1) | eval nativeRequestReceived=mvindex(mvfield,2) | stats sum(nativeResponseSent) sum(nativeRequestReceived) by id ... View more

I would like to create stats from the data whose structure looks like mentioned below: { data: { messageType: Test_LOG myList: { Test1: { counts: { RequestReceived: 2 ResponseSent: 2 negativeResponsesSent: 1 } } , Test2: { counts: { RequestReceived: 1 ResponseSent: 1 negativeResponsesSent: 1 } } } } hostname: ip-12212 name: test-logs nodeEnv: test pid: 4338 time: 2018-05-14T14:53:45.599Z ts: 1526309625599 v: 0 version: 1.1 } How can I create stats such that I get counts for RequestReceived and ResponseSent for Test1 and Test 2. Something like a report below: Tests RequestReceived ResponseSent Test1 2 2 Test2 1 1 ... View more