How to extract multivalue identity fields into their own identities

cpalicensing — Wed, 19 Feb 2020 13:50:20 GMT

The following is a section of an larger JSON data source digested into our Splunk instance:

"identities": [{"issuerAssignedId": "bob.smith@gmail.com", "issuer": "domain.onmicrosoft.com", "signInType": "emailAddress"}, {"issuerAssignedId": "0023587453958742158@domain.onmicrosoft.com", "issuer": "domain.onmicrosoft.com", "signInType": "userPrincipalName"}]

The problem is this data ends up in three multi-valued fields:

identities{}.issuer
identities{}.issuerAssignedId
identities{}.signInType

I need to extract the "identities{}.issuerAssignedId" into their own fields as separate identities. Is this something that can be done at search time, or do I need to add a transform somewhere? If a transform is needed, what could that look like?

Thank you!

Re: How to extract multivalue identity fields into their own identities

to4kawa — Sat, 29 Feb 2020 00:35:08 GMT

your search
| rename identities{}.* as *
| table issuer issuerAssignedId signInType
| eval counter=mvrange(0, mvcount(issuerAssignedId))
| mvexpand counter
| rename counter as _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _counter

topic How to extract multivalue identity fields into their own identities in Getting Data In

How to extract multivalue identity fields into their own identities

Re: How to extract multivalue identity fields into their own identities