@lohitmehta, third query is not a solution approach it is for you to test results. It generates dummy 4000 records for you to test approach 1 and approach 2. We obviously do not have access to your Splunk instance/data. So based on the details provided, we usually cook up similar data to simulate issue and provide solution.
With the 4000 events in JSON data, when I just ran | spath command the Name Status fields got truncated. However, the two approaches mentioned above did return all the results.
PS: For approach 1 you need to enter path as per path in the actual JSON data. I have used path=Status{}.Status as per my cooked up data. Refer to Splunk Documentation for identifying the path using spath command.
For approach 2 with regular expression you can test the regular expression with your raw event samples on regex101.com. Here is a link for regular expression based on your sample data: https://regex101.com/r/PGCsII/1
Also, keep remove the pipe from the end one by one to see which step is not working as expected.
Please do try the run anywhere search and confirm. If it works you just need to replace the query generating cooked up data and plug-in your base search to fetch JSON data.
... View more