found following working    | stats count as Count by attempts | eventstats sum(Count) as Total | eval perc=round((Count/Total)*100,2) | fields - Total | sort 0 - Count | head 10 ... View more

| rex "(?s)\"object\w\":(?<object>.*)" | spath input=object path=attempts{} output=attempts | mvexpand attempts | spath input=attempts path=responses{} output=responses | spath input=responses | where status="SUCCESS" | eval response=floor((responseTime-requestTime)/1000) | stats count by response ... View more