The json screenshot is the result of my search, it returns a single event with nested json. I am attempting to reformat/filter the event output to show only agentName: ether and agentSwitchName: soul, preferably in a tabular format. mysearch | spath agent{} output=agent | mvexpand agent | spath input=agent | search agentName="ether" AND agentSwitchName="soul" | table agentName, agentSwitchName However instead of getting "soul" only, I am getting both "infinity" and "soul", so it looks like This is the output I really want: Thank you
... View more