mvzip, mvexpand and mvindex are simply wrong tools for your data structure. (Well, mvexpand will be needed, but only after you properly handle the array in your data.) As everybody in this post has pointed out: You need to post sample or precise mock data to reveal the structure. (In text, never screenshot.) This is extremely important when asking question about data analytics in a forum. When you force volunteers to read your mind, not only will they get FRUSTRATED, but even if they are willing, most of the time their mind reading will be incorrect. This said, based on your code, I kind of picture together a rough structure of your data. I will use JSON to illustrate. Something like {
"userActions": [
{
"application": "app1",
"name": "action1",
"targetUrl": "url1",
"duration": 1234,
"type": "actiontype1",
"apdexCategory": "SATISFIED"
},
{
"application": "app1",
"name": "action2",
"targetUrl": "url1",
"duration": 2345,
"type": "actiontype1",
"apdexCategory": "DISATISFIED"
},
{
"application": "app1",
"name": "action3",
"targetUrl": "url2",
"duration": 3456,
"type": "actiontype2",
"apdexCategory": "FRUSTRATED"
}
],
"userExperienceScore": "FRUSTRATED",
"events": [
{"application": "xxx", "irrelevant": "aaa"},
{"application": "yyy", "irrelevant": "bbb"}
]
} Your event could be in JSON or it could be in XML, but it contains at least two arrays, events[] and userActions[]. Is this correct? The array events[] is not what frustrates you because its elements and components are no longer needed after initial search. Your end goal from the above three elements of userActions[] is to pick out {
"application": "app1",
"name": "action3",
"targetUrl": "url2",
"duration": 3456,
"type": "actiontype2",
"apdexCategory": "FRUSTRATED"
} and display it in this format: _time Application Action Target_URL Duration_in_Mins User_Action_Type useractions_experience_score 2024-04-18 22:45:22 app1 action3 url2 0.06 actiontype2 FRUSTRATED If the above looks close, the first thing you need to do is to forget all about Splunk's flattened fields userActions{}.*; in fact, discard them all. Use spath to reach elements of this array, then mvexpand over the elements, no funny mvzip business. After that, everything becomes trivial. Using my speculated data, I can reconstruct your SPL into the following to obtain my illustrated output: index="xxx" sourcetype="xxx" source=xxx
events{}.application="xxx" userExperienceScore=FRUSTRATED
| fields - userActions{}.*
| spath path=userActions{}
| mvexpand userActions{}
| spath input=userActions{}
| dedup application name targetUrl
| search apdexCategory = FRUSTRATED application = * name = *
| sort - _time
| rename application as Application, name as Action, targetUrl as Target_URL,
type as User_Action_Type, apdexCategory as useractions_experience_score
| eval Duration_in_Mins = round(duration / 60000, 2)
| table _time, Application, Action, Target_URL,Duration_in_Mins,User_Action_Type,useractions_experience_score Hope this helps. Here is an emulation of my speculated data. Play with it and compare with real data | makeresults
| eval _raw = "{
\"userActions\": [
{
\"application\": \"app1\",
\"name\": \"action1\",
\"targetUrl\": \"url1\",
\"duration\": 1234,
\"type\": \"actiontype1\",
\"apdexCategory\": \"SATISFIED\"
},
{
\"application\": \"app1\",
\"name\": \"action2\",
\"targetUrl\": \"url1\",
\"duration\": 2345,
\"type\": \"actiontype1\",
\"apdexCategory\": \"DISATISFIED\"
},
{
\"application\": \"app1\",
\"name\": \"action3\",
\"targetUrl\": \"url2\",
\"duration\": 3456,
\"type\": \"actiontype2\",
\"apdexCategory\": \"FRUSTRATED\"
}
],
\"userExperienceScore\": \"FRUSTRATED\",
\"events\": [
{\"application\": \"xxx\", \"irrelevant\": \"aaa\"},
{\"application\": \"yyy\", \"irrelevant\": \"bbb\"}
]
}"
| spath
``` data speculation for
index="xxx" sourcetype="xxx" source=xxx events{}.application="xxx" userExperienceScore=FRUSTRATED
```
... View more