You can try using spath to parse it first. Then pull out the fields.
| makeresults
| eval raw="{ \"computer\": { \"extension_attributes\": [ { \"id\": 1, \"name\": \"xxx-enrolled\", \"type\": \"String\", \"value\": \"3\" }, { \"id\": 7, \"name\": \"xxx-filevault\", \"type\": \"String\", \"value\": \"FileVault is On.\" }, { \"id\": 4, \"name\": \"xxx-initial-hostname\", \"type\": \"String\", \"value\": \"xxxx-2i3l\" }, { \"id\": 5, \"name\": \"Host name\", \"type\": \"String\", \"value\": \"xxxx-2i3l\" }, { \"id\": 2, \"name\": \"Last User\", \"type\": \"String\", \"value\": \"\" }, { \"id\": 5, \"name\": \"xxx-enrolled\", \"type\": \"String\", \"value\": \"10\" }, ] } }"
| rename raw AS _raw
| spath
| rename computer.extension_attributes{}.name AS name
| stats count by name
... View more