XQL Query DNS resolutions

[NathanBradley]

I'm attempting to pull out the name, type, and value from the dns_resolutions data

The below query results in "FAILED TO RUN QUERY" with no data, removing the alters does return data however no fields available return "value" in the dns_resolutions 

Any help would be appreciated

preset= network_story
| filter (dns_query_name != null)
| arrayexpand dns_resolutions

| alter DNS_Expand_Name=json_extract(dns_resolutions, "$.name")
| alter DNS_Expand_Type=json_extract(dns_resolutions, "$.type")

| alter DNS_Expand_Value=json_extract(dns_resolutions, "$.value")

below is an example of the expanded view of dns_resolutions

{

  "name": "www.navistechnologies.com",

  "type": "A",

  "value": "199.125.15.90"

}

[bbarmanroy]

Hi @NathanBradley does it work with any one of the alter statements? You can add one alter statement at a time to determine if something is amiss. 
I would also add the following line '| limit 10' and progressively increase the number to determine what is working.

I ran the exact query that you shared and it works just fine.

[NathanBradley]

Same results when i add a single alter.

Also,same failed to run result if i change to dataset=xdr_data