Small tweak to the regex: (removing two space characters from the second-to-last line) | makeresults | eval _raw = "{\"orderNum\":\"1234\",\"orderLocation\":\"demoLoc\",\"details\":{\"key1\":\"value1\",\"key2\":\"value2\"}}" | spath | spath input=_raw path=details output=hold | rex field=hold "\"(?<kvs>[^\"]*\"*[^\"]*\"*[^\"]*\"*)\"" max_match=0 | stats values(*) as * by kvs | rex field=kvs "(?<key>[^\"]*)\":\"(?<value>[^\"]*)" max_match=0 | table orderNum key value orderLocation   If the value can be an escaped JSON string, then indeed you need to be more crafty with the regex. E.g.: | makeresults | eval _raw = "{\"orderNum\":\"1234\",\"orderLocation\":\"demoLoc\",\"details\":{\"key1\":\"{\\\"jsonvalue\\\":\\\"jsonvaluevalue\\\",\\\"jsonvalue2\\\":\\\"jsonvaluevalue2\\\"}\",\"key2\":\"value2\"}}" | spath | spath input=_raw path=details output=hold | rex field=hold "(?<kvs>\"[^\"]*\":\"{?[^}]*}?\")" max_match=0 | stats values(*) as * by kvs | rex field=kvs "(?<key>[^\"]*)\":\"(?<value>{?[^{}]*}?)\"" max_match=0 | table orderNum key value orderLocation ... View more

@yuanliu , I was able to achieve it through this; I missed the part where the value is a multivalued field. After using mvmap, it worked fine.     | rex field=value mode=sed "s/.+=> *//" | eval value = mvmap(value, if(match(value, "#DEL|null"), value, "others")) | stats values(Unique_key) as Unique_key count by value | table Unique_key value count | rename value as "#DEL or null or others"       ... View more