@samgol You can get an approximate count by JSON key schema using something like this: | fields data | spath input=data | fields - data | foreach * [ eval <<FIELD>>="" ] | fieldsummary | fields field count | mvcombine field Note that two schemas with the same field counts will be combined into a single set. Another possibility is removing values and normalizing them to "" in data before grouping: | eval data=replace(data, "\" ?: ?(?:\"(?:\\\"|.*?)\"|[-\d\.eE]+)", "\":\"\"") | stats count by data {"a": "b"} => {"a":""} {"d": "x", "h": "e"} => {"d":"", "h":""} data count {"a":""} 1 {"d":"", "h":""} 1
... View more