Can someone please tell me why this answer isn't working in my 7.1.3? I only get one row instead of the two rows shown above. I'm brand new to Splunk, but this is the 3rd similar example I've tried that is supposed to render multiple rows but does not for me.
| makeresults
| eval _raw="{\"Class\":\"11\",\"date\":\"05/16/2016\",\"Student\":[{\"RollNo\":\"1234\",\"SubjectDetails\":[{\"type\":\"Mandatory\",\"startTime\":\"05/16/2016 21:30\",\"endTime\":\"05/16/2016 22:00\",\"name\":\"English\"},{\"type\":\"Optional\",\"startTime\":\"05/16/2016 20:00\",\"endTime\":\"05/16/2016 21:30\",\"name\":\"Math\"}]}]}"
| spath | rename Student{}.SubjectDetails{}.name AS name, Student{}.SubjectDetails{}.type AS type, Student{}.SubjectDetails{}.endTime as endTime, Student{}.SubjectDetails{}.startTime as startTime, Student{}.RollNo as RollNo
| eval a=mvzip(Class,RollNo)
| eval b=mvzip(date,RollNo)
| eval c=mvzip(RollNo,name)
| eval d=mvzip(name,type)
| eval e=mvzip(name,startTime)
| eval f=mvzip(name,endTime)
| eval g=mvzip(a,b)
| eval h=mvzip(c,d)
| eval i=mvzip(e,f)
| eval j=mvzip(g,h)
| eval k=mvzip(g,i)
| eval x=mvzip(j,k)
| mvexpand x
| eval x=split(x,",")
| eval Class=mvindex(x,0)
| eval RollNo=mvindex(x,1)
| eval date=mvindex(x,2)
| eval name=mvindex(x,5)
| eval type=mvindex(x,7)
| eval startTime=mvindex(x,13)
| eval endTime=mvindex(x,15)
| table Class, RollNo, date, name, type startTime, endTime
... View more