Thanks Team, I am getting same results from all three splunk queries that we discussed. I think this seems to be correct result to me I have one doubt with recent query that you had suggested json_array_mv --> does it convert json array as Json with every array element as Json ?? for example [{a:b}, {c:d}, {e:f}] --> {0:{a:b},1:{c:d},2:{e:f}} then when we do mvcount it counts 0,1,2.... etc Thanks for helping me with this @tscroggins @PickleRick  ... View more

I Think query seems to be working as suggested by you. I manually check for some of events using below query index=myIndex | spath path=resp.meta.bValues{}.aValues{} output=aValues | eval cnt=mvcount(aValues) | table cnt, eventId My bad.  Just recofirming again with you that the above query works with json array in aVaules as well right ?? See below one event for sample Every event has bValues as json array and every bValue has aValues as json array. I want to calculate aValues for all bVaues across all events { resp: { meta: { bValues: [ { aValues: [{e:d, s:h}, {g:i, r:t} ] x: y a: b }, { aValues: [{e1:d1, s1:h1}, {g1:i1, r1:t1} ] x1: y1 a1: b1 } ] } } }   ... View more

Thanks for quick response. The result with query you suggested is same as mine. aValues is json array with multiple fields in each json element. I dont know if its calculating all fields of each aValues. The Value I m getting is much higher in both queries. Is there any simple function to get the size of json array ?? Thanks, Gheri. ... View more

By Length I mean, Json array size inside aValues and bValues. I also tried  index=myIndex | spath path=resp.meta.bValues{}.aValues{} output=allAValues | stats count Its not giving the correct count. I was expected all aValues count. THis is working for small count like 10 but not with million events. ... View more

By records I mean the events. Million events would have aValues and bValues both are json array. I want to get the length of aValues across all events. So for example if there two events and bValues in each event are 2 elements. aValues in all bValues have 4 elemnts. So after this query, I should be able to get length of aValues across all bValues for all events. In the above example output should be 16 as there are total 16 aValues across all bValues for all events. ... View more