https://community.splunk.com/t5/Getting-Data-In/Cloudtrail-JSON-logs-do-not-ingest-into-splunk-in-a-usable/m-p/413821#M73200 <P>The cloudtrail event exports are in JSON with fields, which is great. However, each event has a top level empty piece to the structure that forces you to expand the entire event when looking at it in the gui (the + symbol). It also makes searching on fields incredibly difficult.</P> <P>Is there some app or way to remove that parent level JSON bit with Splunk itself as it ingests? Currently we do it with a python script, but it takes forever to decompress, parse and the compress again.</P> Thu, 16 Aug 2018 18:17:33 GMT thisissplunk 2018-08-16T18:17:33Z https://community.splunk.com/t5/Getting-Data-In/Cloudtrail-JSON-logs-do-not-ingest-into-splunk-in-a-usable/m-p/413821#M73200 <P>The cloudtrail event exports are in JSON with fields, which is great. However, each event has a top level empty piece to the structure that forces you to expand the entire event when looking at it in the gui (the + symbol). It also makes searching on fields incredibly difficult.</P> <P>Is there some app or way to remove that parent level JSON bit with Splunk itself as it ingests? Currently we do it with a python script, but it takes forever to decompress, parse and the compress again.</P> Thu, 16 Aug 2018 18:17:33 GMT https://community.splunk.com/t5/Getting-Data-In/Cloudtrail-JSON-logs-do-not-ingest-into-splunk-in-a-usable/m-p/413821#M73200 thisissplunk 2018-08-16T18:17:33Z