I will check it out. Thanks for the info. ... View more

Hi niketnilay. Thank you for the information. Unfortunately I am new to Splunk. For efficiency it sound like we want to stay away from multi-valued fields once the data is in Splunk. So we would use props.conf or transforms.conf to get the multi-valued JSON data into Splunk where each multi-value would be a single event so in essence we are “flattening” the data, so to speak. Is that correct? Can you recommend some links that discuss the best way to handle this type of data in Splunk? Sorry, I am new to all this. Thank you for any information you could provide regarding this. ... View more

Thank you, everything is working fine now. Thank you for letting me know about that that and for the quick response. ... View more

Thank you for the feedback. I have create a new index with a very small subset of the data and I am able to reproduce the issue. I have included the JSON below so maybe someone can see if they can reproduce it and if not tell me what is wrong with the query and/or data. Thank you. This query works index="test3" | spath output=bDate path=cRecords{}.bDate | eval beginDate = strptime("05/16/2019","%m/%d/%Y") | eval endDate = strptime("05/17/2019","%m/%d/%Y") | eval thisDate = strptime(bDate, "%m/%d/%Y") | where thisDate = beginDate OR thisDate = endDate | stats count(bDate) This query does not index="test3" | spath output=bDate path=cRecords{}.bDate | eval beginDate = strptime("05/16/2019","%m/%d/%Y") | eval endDate = strptime("05/17/2019","%m/%d/%Y") | eval thisDate = strptime(bDate, "%m/%d/%Y") | where thisDate >= beginDate AND thisDate <= endDate | stats count(bDate) Here is the JSON { "cRecords": [ { "bDate": "05/16/2019", "count" : "10", "charge": "100.10", "type": "T", "flag": "Y" }, { "bDate": "05/16/2019", "count": "100", "charge": "10000.01", "type": "P", "flag": "X" } ], "batch": "1" } { "cRecords": [ { "bDate": "05/17/2019", "count" : "1", "charge": "1.00", "type": "P", "flag": "Y" }, { "bDate": "05/17/2019", "count": "5", "charge": "25.25", "type": "T", "flag": "X" } ], "batch": "2" } ... View more

Hi Moderator, sorry I accidentally posted a comment as an answer. Please disregard the answer post and post the comment. Thank you. ... View more

Thanks for all the feedback. I am going over it. What I can tell you is that if I try this it works: index="test2" | spath output=bDate path=cRecords{}.bDate | eval beginDate = strptime("05/16/2019","%m/%d/%Y") | eval endDate = strptime("05/17/2019","%m/%d/%Y") | eval thisDate = strptime(bDate, "%m/%d/%Y") | where thisDate = beginDate | stats count(bDate) But if I use >= (instead of 😃 it returns 0 events and a count of 0 so it seems there is an issue maybe with thisDate being considered as a string instead of a date? Also, if I try where thisDate = beginDate OR thisDate = endDate I also get 2 results and a count of 496. Putting double quotes around cRecords{}.bDate has no effetc, i.e. using this: | spath output=bDate path="cRecords{}.bDate" instead of this: | spath output=bDate path=cRecords{}.bDate does not resolve the issue ... View more