https://community.splunk.com/t5/Getting-Data-In/Possible-to-set-fields-in-transforms-conf-for-a-field-in-a-JSON/m-p/442850#M77141 <P>We are using the Splunk Shibboleth add on app but unfortunately our Shib audit events are formatted as JSON and it's nullifying the audit fields in the transforms.conf file:</P> <PRE><CODE>[shibboleth:audit-fields] DELIMS = "|" FIELDS = auditEventTime,requestBinding,requestId,relyingPartyId,messageProfileId,assertingPartyId,responseBinding,responseId,principalName,authNMethod,releasedAttributeId1,releasedAttributeId2,nameIdentifier,assertion1ID,assertion2ID </CODE></PRE> <P>All of the K/V pairs that should be parsed are in the 'Event' field in the JSON formatted event with the | delimiter. </P> <P>Is there a way to modify the transforms.conf file so that it looks in the Event field for the values to parse?</P> Wed, 08 May 2019 15:03:10 GMT jwalzerpitt 2019-05-08T15:03:10Z https://community.splunk.com/t5/Getting-Data-In/Possible-to-set-fields-in-transforms-conf-for-a-field-in-a-JSON/m-p/442850#M77141 <P>We are using the Splunk Shibboleth add on app but unfortunately our Shib audit events are formatted as JSON and it's nullifying the audit fields in the transforms.conf file:</P> <PRE><CODE>[shibboleth:audit-fields] DELIMS = "|" FIELDS = auditEventTime,requestBinding,requestId,relyingPartyId,messageProfileId,assertingPartyId,responseBinding,responseId,principalName,authNMethod,releasedAttributeId1,releasedAttributeId2,nameIdentifier,assertion1ID,assertion2ID </CODE></PRE> <P>All of the K/V pairs that should be parsed are in the 'Event' field in the JSON formatted event with the | delimiter. </P> <P>Is there a way to modify the transforms.conf file so that it looks in the Event field for the values to parse?</P> Wed, 08 May 2019 15:03:10 GMT https://community.splunk.com/t5/Getting-Data-In/Possible-to-set-fields-in-transforms-conf-for-a-field-in-a-JSON/m-p/442850#M77141 jwalzerpitt 2019-05-08T15:03:10Z https://community.splunk.com/t5/Getting-Data-In/Possible-to-set-fields-in-transforms-conf-for-a-field-in-a-JSON/m-p/442851#M77142 <P>To turn off automatic JSON interpretation, do this on your search head:</P> <PRE><CODE>[shibboleth:audit-fields] KV_MODE = none AUTO_KV_JSON = false </CODE></PRE> Sun, 12 May 2019 04:27:57 GMT https://community.splunk.com/t5/Getting-Data-In/Possible-to-set-fields-in-transforms-conf-for-a-field-in-a-JSON/m-p/442851#M77142 woodcock 2019-05-12T04:27:57Z