I have a dataset with a multiline field called Logs. The field typically has values like the below,     "mId": "Null", "deviceID": "a398Z389j", "cSession": "443", "cWeb": "443", "uWeb": "Mixed", "s": "Steak", "Ing": [ "1-555-5555555", "1-888-8888888" ], "Sem": [ "Warehouse@Forest.box" ]     I'd like to make it so I can identify the values within "Ing" and easily search where a specific value is in "Ing" for other events. I was able to break it out and split on the comma and then look at the index number 6 but this only returns the 1st item, where in most events there are multiple (upwards of 10) items.   | eval a = mvindex(split(Logs,","), 6) "Ing": [ "1-555-5555555"   Thoughts on how to get a complete list of the items in Ing? ... View more

I'm struggling to create a sankey diagram that take an initial username and connects that user to IP addresses that are associated with that username. Then, take that IP address and see what other usernames might be associated with that IP address. My initial search gets a list of IP addresses that is associated with a username. This works well, then I do the stats on those results and it looks great with sankey,       | stats count by username IP | rename username AS user IP AS address           The problem comes with I try to append the second level of the sankey. I'm not quite sure how to take the address on the far right and create that second level, looking for associated usernames. My intention is to only go 3 levels. I assume I have to search by 'address' in my dataset to see what username is associated? ... View more