Thank you for the hint.    I tried to add the clause below and the data returned correctly.   | rename data as _raw | extract ... View more

The json screenshot is the result of my search, it returns a single event with nested json.   I am attempting to reformat/filter the event output to show only agentName: ether and agentSwitchName: soul, preferably in a tabular format.  mysearch |  spath agent{} output=agent | mvexpand agent | spath input=agent | search agentName="ether" AND agentSwitchName="soul"  | table agentName, agentSwitchName However instead of getting "soul" only, I am getting both "infinity" and "soul", so it looks like  This is the output I really want:  Thank you ... View more

Hi @to4kawa , thank you, i have one more request,  my search correctly returns agent ether, however, it also returns all agent switch names even though I specified agentSwitchName "soul".   I think this has to do with agentSwitchName being nested within agent.   Could you help ? mysearch |  spath agent{} output=agent | mvexpand agent | spath input=agent | search agentName="ether" AND agentSwitchName="soul"   ... View more