Thanks, @dtburrows3 To format the results as we need them, I’m using this code, which works perfectly. ```My code: Part 2```
| rex field="summation_json" "sum\"\:(?<nums_expanded>\d+)\}"
| fields nums_expanded
| mvexpand nums_expanded However, when I replace your makeresults with my inputlookup of 3 million records, ```My code: Part 1```
| inputlookup direct_deposit_changes_v4_1_since_01012020.csv
| eval _time = strptime(_time,"%Y-%m-%d")
| stats count as daily_count by _time
| eval daily_count = daily_count.","
| mvcombine daily_count
| eval daily_count = mvjoin(daily_count,"")
```Your code: renamed nums to daily_count.```
| eval cnt=0
| foreach mode=multivalue daily_count
[| eval summation_json=if( mvcount(mvindex(daily_count,cnt,cnt+2))==3,
mvappend( 'summation_json', json_object( "set",
mvindex(daily_count,cnt,cnt+2), "sum",
sum(mvindex(daily_count,cnt,cnt+2)) ) ), 'summation_json' ), cnt='cnt'+1 ]
```My code: Part 2```
| rex field="summation_json" "sum\"\:(?<sum_daily_count>\d+)\}"
| fields sum_daily_count
| mvexpand sum_daily_count I end up with this error. When I run My code: Part 1, these are the results. Running this at the end of My code: Part 1, proves there are over 1465 values (all values from my stats count by _time command). | eval mv_cnt = mvcount(split(daily_count,","))-1 Thanks and God bless, Genesius
... View more