You are almost there - after the spath, copy the message field to _raw and run extract. The stats might be better as sums rather than counts, but it depends what it is that you are trying to get | makeresults | eval _raw="{ \"timestamp\":\"2021-04-22T09:14:38.727Z\", \"message\":\"Metrics: key1=false, [SystemMetricsBean] key2=key2val, [MetricAttributes] sumCountViaMetricsAnnotation=2, failureCount=0, sumDuration=46, minDuration=22, maxDuration=24, sumCountViaCacheAnnotation=2, numWithoutCache=2, numDisableCache=2\", \"version\":\"1.1.0\" }" | spath path=message,output=metrics | eval _raw=metrics | extract | stats sum(sumDuration) as duration, sum(failureCount) as fail ... View more