HI @Strangertinz, Try this search: | makeresults | eval _raw="{ \"Key1\": \"Value1\", \"Key2\": { \"subKey2_1\": \"sub value1 for key2\", \"Manifest\": [{ \"flight\": \"start\", \"City\": \"Los Angeles\", \"code\": 7870, \"Inventory\": { \"snacks\": 300, \"status\": \"full\" } }, { \"flight\": \"end\", \"City\": \"Las Vegas\", \"code\": 7470, \"Inventory\": { \"snacks\": 56, \"status\": \"near empty\" } } ], \"subKey2_3\": \"sub value3 for key2\" }, \"Key3\": \"Value3\", \"Key4\": \"Value4\"}"
| fromjson _raw
``` Above is just to format the data into a JSON event```
``` Get the JSON data from Key2```
| fromjson Key2
``` Split out the origin and destination fields```
| eval Origin = mvindex(Manifest,0)
| eval Destination = mvindex(Manifest,1)
| fields - Manifest, _raw, _time, Key2
``` Update the field names so we know which was Origin and which was Destination```
| rex mode=sed field=Origin "s/\"([^\"]+)\":/\"\\1_Origin\":/g"
| rex mode=sed field=Destination "s/\"([^\"]+)\":/\"\\1_Destination\":/g"
``` Extract all the fields from the JSON array ```
| fromjson Destination
| fromjson Origin
| fromjson Inventory_Destination
| fromjson Inventory_Origin
| fields - Inventory_End, Inventory_Origin
``` Table everything out on one row ```
| table City_Origin, code_Origin, snacks_Origin, status_Origin, City_Destination, code_Destination, snacks_Destination, status_Destination I'm using rex mode=sed to update the JSON with more descriptive names for the duplicated fields. The output is: Is that what you were looking for? Cheers Daniel
... View more
