Issue getting records from events attribute

[nisah]

suites:{"name":"tests > GetByVINTest","count":13,"passed":10,"failed":3,"skipped":0}, {"name":"tests > SearchEngineTest","count":70,"passed":70,"failed":0,"skipped":0}, {"name":"tests > VinCheckTest","count":11,"passed":11,"failed":0,"skipped":0}

Have this event attribute (suites).

Trying to get the values as a table using the below dql. But I'm only getting the first record in the suites string. Attached screenshot in the post. How could I retrieve all the 3 records?

fetch events
 filter event.kind == "SDLC_EVENT" AND event.category == "test"
| fields suites, timestamp, suiteCount, environment, group
| filter isNotNull(suiteCount)
| filter isNotNull(suites)
| expand suites
| parse suites, "JSON:json"

screenshot below. 

[marco_irmer]

The issue here is that the JSON parser on its own will not handle multiple JSON objects. There's a JSON_ARRAY parser, but your data doesn't appear to be structured as a JSON array. But not to worry, we can combine the JSON parser with the ARRAY parser to extract all three. We also need to move the expand command down in the query so that it executes AFTER we have a valid array that can be expanded.

The revised DQL would look like this:

fetch events
 filter event.kind == "SDLC_EVENT" AND event.category == "test"
| fields suites, timestamp, suiteCount, environment, group
| filter isNotNull(suiteCount)
| filter isNotNull(suites)
| parse suites, "ARRAY{JSON:json ', '?}{1,}:suite"
| expand suite

Output in Playground: