BElow query shows expected statistics table in Splunk 8.2, but shows only events in Splunk 6.2.   YOUR_SEARCH | fields A_real.S*.A* | rename A_real.* as * |eval dummy=null() | foreach S* [ eval dummy= if(isnull(dummy),"<<FIELD>>".":".'<<FIELD>>',dummy."|"."<<FIELD>>".":".'<<FIELD>>') ] | eval dummy=split(dummy,"|") | stats count by dummy | fields - count | eval f1= mvindex(split(dummy,"."),0),I1= mvindex(split(dummy,"."),1), Id=mvindex(split(I1,":"),0),{f1}=mvindex(split(I1,":"),1) | fields - dummy I1 f1 | stats values(*) as * by Id | lookup YOUR_LOOKUP Id | where isnotnull(Timestamp) | fields - Timestamp Please check. ... View more

I have json in following format.   { "timestamp": "1625577829075", "debug": "true", "A_real": { "Sig1": { "A01": "Pass", "A02": "FAIL", "A03": "FAIL", "A04": "FAIL", "A05": "Pass", "finalEntry": "true" }, "Sig2": { "A01": "Pass", "A02": "FAIL", "A03": "FAIL", "A04": "Pass", "A05": "FAIL", "finalEntry": "true" }, "finalEntry": "true" } }   and one csv file as following: Id Timestamp A02 T1 A03 T2 A05 T3 I want to create a saved search using outer join on Id and transpose which gives me result as following: Id             Sig1            Sig2 A02         Fail             Fail A03         Fail              Fail A05         Pass          Fail   Please sugget query. ... View more