@yuanliu Thanks for quick response. It make more sense now. The challenge now is the extract the array value on Tags{Name}.Key bring up the count of the values but, not nested values within the Name Field that has the value We want index=aws sourcetype="aws:metadata" InstanceId=i-*
| spath Tags{}.Value output=Hostname
| mvexpand Hostname
| fieldsummary
| search field = Hostname Return the results on the screen shot. Notice that the count of value and field values mixed. that's the part I don't get and trying to understand. Hostname only returns the count. "Field name in SPL uses dot (".") to segment data paths in JSON, and curly brackets ({}) to represent a JSON array. " So, should the path Tags.Key.Name{} return the values for Name array not the count of the values | spath Tags.Key.Name{} output=Name Yes. I am having problem understanding the path logic based on the results. The question is how do retrieve the values in 3 depth array into muti-value? index=aws sourcetype="aws:metadata" InstanceId=i-*
| spath path="Tags{}.Value" output=Name
| mvexpand Name
| search Name = I-*
| stats count by Name This get the results in Value but, my understanding of it still rough. I need extract more tag.values{} in tag.values as fields with value instead of the values to re-do a savesearch that rely tag.$field_name$ Now it's broken out into Value being the field value where key is the field name. I think, I need to group them. Right?
... View more