Thanks KV, That looks like much more maintainable code. 😀  One last think, I wanted to create a timechart also off the data but it fails once i use a real index instead of make results. I am presuming it has something to do with _time not being in the result set: index=myIndex source=mySource  spath path=sp_v{} output=data | stats count by data | rename data as _raw | extract | timechart span=1d count(bu)  useother=f usenull=f   Any ideas? Kind Regards, Maurice ... View more

Thanks KV,  That works great.  My only issue is that in my dashboard I am building up this query using inputs (for most properties on the array). So there could be up to 7 or 8 properties to search on. I notice from the docs that mvzip only works with 2 properties by default. so I tried with 3 which worked(see below): |makeresults |eval _raw ="{ \"sp_v\":[ {\"bu\":\"blob\",\"disp\":\"enforce\", \"an\":\"test\"}, {\"bu\":\"inline\",\"disp\":\"report\", \"an\":\"another\"} ] }" | spath | rename sp_v{}.* as * | eval t = mvzip(mvzip(bu,disp), an) | mvexpand t | eval bu=mvindex(split(t,","),0),disp=mvindex(split(t,","),1), an=mvindex(split(t,","),2) | where bu="blob" AND disp="enforce" AND an="test"   I'd imagine the code would become hard to read as I have to nest mvzip inside itself and also change the index Do you know of a more readable way it accomplish this with  more properties? Kind regards, Maurice ... View more

Thanks a million for the reply. It really helped focus me in the correct direction. I ended up having to put an explicit spath before each of my search command that referenced one of the complex object properties. similar to:     | spath books{}.name | search books{}.name | top books{}.name       ... View more