Here is a solution without using mvzip:
| makeresults
| eval _raw="{ \"storeID\":\"000\",
\"activeStatus\":\"Active\",
\"location\":{
\"addressLine1\":\"4300 Store Rd\",
\"city\":\"Atlanta\",
\"zip\":\"99999\",
\"state\":\"GA\",
\"mainNumber\":\"9999999999\" },
\"capabilities\":[
{\"name\":\"Sales\", \"startDateUtc\":\"2019-11-10T07:00:00\"},
{\"name\":\"Accounting\", \"startDateUtc\":\"2019-12-05T07:00:00\"},
{\"name\":\"Shipping\", \"startDateUtc\":\"2019-10-23T07:00:00\"},
{\"name\":\"Executive\", \"startDateUtc\":\"2019-10-23T07:00:00\"},
{\"name\":\"Delivery\", \"startDateUtc\":\"2019-10-23T07:00:00\"}
]}"
| spath output=capabilities path=capabilities{}
| mvexpand capabilities
| spath input=capabilities
| eval today=strftime(now(), "%Y-%m-%d")
| where match(startDateUtc, today)
| table name, startDateUtc
... View more
