Heyyy!  @ITWhisperer Thank you so much for the helpful reply!🙂 It does separate data into different rows. However, when I bring data from other service/actions,  data is not combined in a expected way.  Since it is my second week using Splunk, please excuse my native & obvious questions.😅 Below are some detailed explanations & screenshots. results (where accountAction actionAvailable actionNotAvailableReason are from) is from  action=getAccountAvailableActions specialtyProduct is from action=getServiceabilityByAddressId_V3 customerType is from "isRepeatTroubleCallEligible"  Below is the query I used to test. As you can see, either data source will be "null",  and when I search for both of them are not "null", it returns no result. When I tried to aggregate data a little bit to ensure there are data showing up, it just goes back to the stacked result😢   Below is the final query I have came up with. What I eventually want to achieve is a result that I can filter on by playing with customerType, accountAction, smb_ind and actionAvailable to do some negative tests to monitor if the backend logics for different accountActions (such as Multi-AP Salable) are running correct or not. Due to the multiple returned values from JSON array, statistics table is not showing the correct result at this moment.  For example, for the highlighted transaction_id, actionAvailable returns "Y" in the table, but when I dive into  event. it actually is N when accountAction is Multi-AP Salable. Please see the screenshot I attached in the message.       Thank you again for the responsive reply. Looking forward to hearing insights from you very soon! Cheers! ... View more