First of all, please post sample data in text, not in screenshot. It is much easier for other people to help. Secondly, the screenshot shows invalid JSON syntax. Assuming actual data are conformant, the following should give you the desired outcome | spath path=group_name
| spath output=sub_groups path=group.sub_groups{}
| mvexpand sub_groups
| spath input=sub_groups path=subgroup
| spath input=sub_groups output=subsubgroup path=subsubgroup{}
| fields - sub_groups ``` just to clear view, not part of calculation ```
| mvexpand subsubgroup
| spath input=subsubgroup
| table group_name subgroup team "some other info" In the above, I didn't bother to rename fields; for example, "team" is subsubgroup, etc. In input data, I assumed that there is a field "some other info" under subsubgroup. Given test data as follows (which you should have supplied in text): {"event":"A",
"group_name":"alpha",
"group":{
"group_name":"alpha",
"sub_groups":[
{"subgroup":"alpha1",
"subsubgroup": [
{"team":"beta"},
{"team":"gamma", "some other info":"foo"}]
},
{"subgroup":"alpha2",
"subsubgroup": [
{"team":"a"},
{"team":"b", "some other info":"bar"}]
},
{"subgroup": "alpha3",
"subsubgroup": [
{"team": "uno", "some other info":"baz"}]
}
]
}
} output would be group_name subgroup team some other info alpha alpha1 beta alpha alpha1 gamma foo alpha alpha2 a alpha alpha2 b bar alpha alpha3 uno baz
... View more
