@badari  Can you please try this?   YOUR_SEARCH |spath message.data.status | rename message.data.* as * | table status | transpose     My Sample Search :   | makeresults | eval _raw="{\"@timestamp\": \"2021-06-03T17:39:34.720+00:00\",\"@version\": \"1\", \"correlation\": \"test12345\",\"message\":{\"code\":200,\"data\":{\"status\":\"status1234\"}}}"|spath message.data.status | rename message.data.* as * | table status | transpose          Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more