I have a search where 2 of the fields returned are based on the following JSON structure: "tags": [         {             "key": "My Key to Search For",             "value": "The value I want to see",         },         {             "key": "Some other key",             "value": "some value",         }]   I can get the data in a table, eg:     |table asset,tags{}.key,tags{}.value   In my search this will list all my assets, each with their respective tag keys and values as lists in their own fields.  asset tags{}.key tags{}.value asset_001 [TAG_001, TAG_002] [VALUE_001, VALUE002] asset_002 [TAG_001] [VALUE_001]   I now want to create a new field based on these tags, where:   mynewfield = tags{}.value where tags{}.key = "My Key to Search For"   so that: asset mynewfield asset_001 VALUE_002 asset_002 NONE   I tried using eval and mvfilter but I cannot seem to get the statements right, and I'm sure I'm missing something.  Can anyone shed some light on how to do this in a Splunk search?    ... View more