I have an inputlookup table, in this lookup table there is a JSON array called "Evidence" There is two field I would like to extract, one is "Rule" and the "Criticality". An example of Evidence array will look like this: {"Evidence":[{"Rule":"Observed in the Wild Telemetry","Criticality":1},{"Rule":"Recent DDoS","Criticality":3}]} So if I eval both "Rule" and Criticality" as shown below: | eval "Rule"=spath(Evidence, "Evidence{}.Rule") | eval "Criticality"=spath(Evidence, "Evidence{}.Criticality") | table Rule Criticality The output will show like this but the Rule & Criticality column doesn't separate into different row (it is all in one row): Rule Criticality Observed in the Wild Telemetry Recent DDoS 1 3 Now the tricky part, I would like display the top count of Rule (top Rule limit=10)  but at the same time display the associated Criticality with the Rule. How do it? since the above does not separate into different row. The final outlook I am looking for, will look like this: Rule Criticality Count Observed in the Wild Telemetry 1 50 Recent DDoS 3 2 An alternative I was thinking was using foreach then concate it into a Combined Field, but I think It is kind of complex. ... View more