Be sure to try mine; it should scale better and is much shorter. ... View more

This worked! Thank you very much! ... View more

| makeresults | eval _raw ="{\"line\": { \"message\": { \"space-document\": { \"elements\": [ { \"x\": 38, \"y\": 1664 }, { \"id\": \"ac5q3ghn\", \"x\": 38, \"y\": 708 } ] } } } }" | spath for this result, y is multivalue. | makeresults | eval _raw ="{\"line\": { \"message\": { \"space-document\": { \"elements\": [ { \"x\": 38, \"y\": 1664 }, { \"id\": \"ac5q3ghn\", \"x\": 38, \"y\": 708 } ] } } } }" | spath | eval y='line.message.space-document.elements{}.y' | eval count = mvcount(mvfilter(y>=1664)) | eventstats sum(count) as Total If y is counted, it will look like this. ... View more