Hi all, I need your help with a query to extract the values of fields with multiple values. The problem I'm facing is that not every JSON structure has the two values that I need to extract (Name and Value). Below is an example of the log: "OperationProperties": [{ "Name": "Actions", "Value": "XX" }, { "Name": "Conditions", "Value": "XX" }, { "Name": "Provider", "Value": "XX" }, { "Name": "RemoveOutlookRuleBlob" }, { "Name": "Name", "Value": "XX" }, { "Name": "IsNew" }, { "Name": "IsDirty", "Value": "XX" }, { "Name": "RuleOperation", "Value": "XX" }, { "Name": "ServerRule", "Value": "XX" }], The fields 'Name: IsNew' and 'Name:RemoveOutlookRuleBlob' do not have the corresponding 'Value:' field. I tried the following search, but I noticed that when the 'Value' field doesn't exist, it aggregates with the next available 'Value' field. base search.... | spath path=OperationProperties{}.Name output=Name | spath path=OperationProperties{}.Value output=Value | eval temp=mvzip(Name, Value) | table Name Value, temp temp Actions,ForwardToRecipientsAction Conditions,SentToRecipientsCondition,FromRecipientsCondition Provider,RuleOrganizer RemoveOutlookRuleBlob,XXX Name,True IsNew,Delete IsDirty, XX *The 'IsNew' field does not have 'True' value, as you can see in the first image. My final search will looks like this after I correct the Name=Value. base search... | spath path=OperationProperties{}.Name output=Name | spath path=OperationProperties{}.Value output=Value | eval temp=mvzip(Name, Value) | mvexpand temp | eval Name=mvindex(split(temp,","),0), Value=mvindex(split(temp,","),1), Value=mvindex(split(temp,","),2) | eval {Name}=Value | stats values(*) as * by _time Id Can I have any solutions here? Thank you.
... View more
