title: Splunk : Spath searching the JSON array
body: <p>I have below two JSON events where under &quot;appliedConditionalAccessPolicies&quot;, in one event policy1 has results =failure and policy2 has results=notApplied. In the other event the values are reversed.</p>
  <p>Now I'm trying to get the event where the policy1 has the status=&quot;failure&quot;, it gives both the events</p>
  <pre><code>index=test
  | spath path=&quot;appliedConditionalAccessPolicies{}&quot; | search &quot;appliedConditionalAccessPolicies{}.displayName&quot;=&quot;policy1&quot; &quot;appliedConditionalAccessPolicies{}.result&quot;=&quot;failure&quot;
  </code></pre>
  <p>It looks like Its searching within all the elements in the array.
  How can I ensure It searches both the conditions on each element of the array and return the event which has the element satisfying both the conditions.</p>
  <p>Events :</p>
  <pre><code> appDisplayName: App1
     appId: aaaa-1111-111aeff-aad222221111
     appliedConditionalAccessPolicies: [ 
       { 
         displayName: policy1
         enforcedGrantControls: [
           Block
         ]
         enforcedSessionControls: [
           SignInFrequency
           ContinuousAccessEvaluation
         ]
         id: f111113-111-400c-a251-2123bbe4233e1
         result: failure
       }
       { [-]
         displayName: policy2
         enforcedGrantControls: [ [-]
           Block
         ]
         enforcedSessionControls: [ [-]
         ]
         id: sdsds-8c92-45ef-sdsds-c0b2e006d39b
         result: notApplied
       }
     ]
     
     appDisplayName: App1
     appId: aaaa-1111-111aeff-aad222221111
     appliedConditionalAccessPolicies: [ 
       { 
         displayName: policy1
         enforcedGrantControls: [
           Block
         ]
         enforcedSessionControls: [
           SignInFrequency
           ContinuousAccessEvaluation
         ]
         id: f111113-111-400c-a251-2123bbe4233e1
         result: notApplied
       }
       { [-]
         displayName: policy2
         enforcedGrantControls: [ [-]
           Block
         ]
         enforcedSessionControls: [ [-]
         ]
         id: sdsds-8c92-45ef-sdsds-c0b2e006d39b
         result: failure
       }
     ]
  </code></pre>