topic Re: Json object key value differences as output in Splunk Search

Json object key value differences as output

vikashumble — Fri, 28 Feb 2025 09:57:36 GMT

Hello All,

I have a use case where in need to compare two json objects and highlight their key value differences. This is just to ensure that we can let OSC know only about the changes that has been made rather than sending both old and new json as as alert. Is that doable? I tried using foreach, spath, mvexpand but not able to figure out a proper working solution. Any help on this is much appreciated.

Json1:

{
"id": "XXXXX",
"displayName": "ANY DISPLAY NAME",
"createdDateTime": "2021-10-05T07:01:58.275401+00:00",
"modifiedDateTime": "2025-02-05T10:30:40.0351794+00:00",
"state": "enabled",
"conditions": {
"applications": {
"includeApplications": [
"YYYYY"
],
"excludeApplications": [],
"includeUserActions": [],
"includeAuthenticationContextClassReferences": [],
"applicationFilter": null
},
"users": {
"includeUsers": [],
"excludeUsers": [],
"includeGroups": [
"USERGROUP1",
"USERGROUP2"
],
"excludeGroups": [],
"includeRoles": [],
"excludeRoles": []
},
"userRiskLevels": [],
"signInRiskLevels": [],
"clientAppTypes": [
"all"
],
"servicePrincipalRiskLevels": []
},
"grantControls": {
"operator": "OR",
"builtInControls": [
"mfa"
],
"customAuthenticationFactors": [],
"termsOfUse": []
},
"sessionControls": {
"cloudAppSecurity": {
"cloudAppSecurityType": "monitor",
"isEnabled": true
},
"signInFrequency": {
"value": 1,
"type": "hours",
"authenticationType": "primaryAndSecondaryAuthentication",
"frequencyInterval": "timeBased",
"isEnabled": true
}
}
}

json2:

{
"id": "XXXXX",
"displayName": "ANY DISPLAY NAME 1",
"createdDateTime": "2021-10-05T07:01:58.275401+00:00",
"modifiedDateTime": "2025-02-06T10:30:40.0351794+00:00",
"state": "enabled",
"conditions": {
"applications": {
"includeApplications": [
"YYYYY"
],
"excludeApplications": [],
"includeUserActions": [],
"includeAuthenticationContextClassReferences": [],
"applicationFilter": null
},
"users": {
"includeUsers": [],
"excludeUsers": [],
"includeGroups": [
"USERGROUP1",
"USERGROUP2",

"USERGROUP3"
],
"excludeGroups": [

"USERGROUP4"

],
"includeRoles": [],
"excludeRoles": []
},
"userRiskLevels": [],
"signInRiskLevels": [],
"clientAppTypes": [
"all"
],
"servicePrincipalRiskLevels": []
},
"grantControls": {
"operator": "OR",
"builtInControls": [
"mfa"
],
"customAuthenticationFactors": [],
"termsOfUse": []
},
"sessionControls": {
"cloudAppSecurity": {
"cloudAppSecurityType": "block",
"isEnabled": true
},
"signInFrequency": {
"value": 2,
"type": "hours",
"authenticationType": "primaryAndSecondaryAuthentication",
"frequencyInterval": "timeBased",
"isEnabled": true
}
}
}

Output expected (Based on above sample jsons):

KeyName , Old Value, New Value

displayName, "ANY DISPLAY NAME", "ANY DISPLAY NAME 1"

modifiedDateTime, "2025-02-05T10:30:40.0351794+00:00", "2025-02-06T10:30:40.0351794+00:00"

users."includeGroups", ["USERGROUP1","USERGROUP2"], ["USERGROUP1","USERGROUP2", "USERGROUP3"]

"excludeGroups",[],["USERGROUP4"]

sessionControls."cloudAppSecurityType","moitor","block"

signInFrequency."value",1,2

Thanks

Re: Json object key value differences as output

livehybrid — Fri, 28 Feb 2025 11:03:44 GMT

Hi @vikashumble

I think this solution on another question might work for you, instead of me copying it over, check out https://community.splunk.com/t5/Dashboards-Visualizations/How-to-find-and-show-unique-and-missing-keys-between-two-JSON/m-p/675785 so you can get the full context.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: Json object key value differences as output

ITWhisperer — Fri, 28 Feb 2025 11:31:04 GMT

Assuming your fields have already been extracted, try something like this

| transpose 0 column_name="KeyName" | rename "row 1" as OldValue, "row 2" as NewValue | eval diff=if(OldValue!=NewValue,1,null()) | where diff=1

Re: Json object key value differences as output

vikashumble — Fri, 28 Feb 2025 12:28:51 GMT

Hey @ITWhisperer , Can you please guide me a bit more on what you meant may be by a simpler example? It would help a lot. Also I forgot to mention that it is coming from the same event

Thanks

Re: Json object key value differences as output

kiran_panchavat — Fri, 28 Feb 2025 12:39:37 GMT

@vikashumble

| makeresults 
| eval json1="{\"id\": \"XXXXX\",\"displayName\": \"ANY DISPLAY NAME\",\"createdDateTime\": \"2021-10-05T07:01:58.275401+00:00\",\"modifiedDateTime\": \"2025-02-05T10:30:40.0351794+00:00\",\"state\": \"enabled\",\"conditions\": {\"applications\": {\"includeApplications\": [\"YYYYY\"],\"excludeApplications\": [],\"includeUserActions\": [],\"includeAuthenticationContextClassReferences\": [],\"applicationFilter\": null},\"users\": {\"includeUsers\": [],\"excludeUsers\": [],\"includeGroups\": [\"USERGROUP1\", \"USERGROUP2\"],\"excludeGroups\": [],\"includeRoles\": [],\"excludeRoles\": []},\"userRiskLevels\": [],\"signInRiskLevels\": [],\"clientAppTypes\": [\"all\"],\"servicePrincipalRiskLevels\": []},\"grantControls\": {\"operator\": \"OR\",\"builtInControls\": [\"mfa\"],\"customAuthenticationFactors\": [],\"termsOfUse\": []},\"sessionControls\": {\"cloudAppSecurity\": {\"cloudAppSecurityType\": \"monitor\",\"isEnabled\": true},\"signInFrequency\": {\"value\": 1,\"type\": \"hours\",\"authenticationType\": \"primaryAndSecondaryAuthentication\",\"frequencyInterval\": \"timeBased\",\"isEnabled\": true}}}"
| eval json2="{\"id\": \"XXXXX\",\"displayName\": \"ANY DISPLAY NAME 1\",\"createdDateTime\": \"2021-10-05T07:01:58.275401+00:00\",\"modifiedDateTime\": \"2025-02-06T10:30:40.0351794+00:00\",\"state\": \"enabled\",\"conditions\": {\"applications\": {\"includeApplications\": [\"YYYYY\"],\"excludeApplications\": [],\"includeUserActions\": [],\"includeAuthenticationContextClassReferences\": [],\"applicationFilter\": null},\"users\": {\"includeUsers\": [],\"excludeUsers\": [],\"includeGroups\": [\"USERGROUP1\", \"USERGROUP2\", \"USERGROUP3\"],\"excludeGroups\": [\"USERGROUP4\"],\"includeRoles\": [],\"excludeRoles\": []},\"userRiskLevels\": [],\"signInRiskLevels\": [],\"clientAppTypes\": [\"all\"],\"servicePrincipalRiskLevels\": []},\"grantControls\": {\"operator\": \"OR\",\"builtInControls\": [\"mfa\"],\"customAuthenticationFactors\": [],\"termsOfUse\": []},\"sessionControls\": {\"cloudAppSecurity\": {\"cloudAppSecurityType\": \"block\",\"isEnabled\": true},\"signInFrequency\": {\"value\": 2,\"type\": \"hours\",\"authenticationType\": \"primaryAndSecondaryAuthentication\",\"frequencyInterval\": \"timeBased\",\"isEnabled\": true}}}"
| spath input=json1 path="displayName" output=displayName_old
| spath input=json2 path="displayName" output=displayName_new
| spath input=json1 path="modifiedDateTime" output=modifiedDateTime_old
| spath input=json2 path="modifiedDateTime" output=modifiedDateTime_new
| spath input=json1 path="conditions.users.includeGroups{}" output=includeGroups_old
| spath input=json2 path="conditions.users.includeGroups{}" output=includeGroups_new
| spath input=json1 path="conditions.users.excludeGroups{}" output=excludeGroups_old
| spath input=json2 path="conditions.users.excludeGroups{}" output=excludeGroups_new
| spath input=json1 path="sessionControls.cloudAppSecurity.cloudAppSecurityType" output=cloudAppSecurityType_old
| spath input=json2 path="sessionControls.cloudAppSecurity.cloudAppSecurityType" output=cloudAppSecurityType_new
| spath input=json1 path="sessionControls.signInFrequency.value" output=signInFrequencyValue_old
| spath input=json2 path="sessionControls.signInFrequency.value" output=signInFrequencyValue_new
| eval changes=mvappend(
if(displayName_old!=displayName_new, "displayName, ".displayName_old.", ".displayName_new, null()),
if(modifiedDateTime_old!=modifiedDateTime_new, "modifiedDateTime, ".modifiedDateTime_old.", ".modifiedDateTime_new, null()),
if(includeGroups_old!=includeGroups_new, "users.includeGroups, ".includeGroups_old.", ".includeGroups_new, null()),
if(excludeGroups_old!=excludeGroups_new, "users.excludeGroups, ".excludeGroups_old.", ".excludeGroups_new, null()),
if(cloudAppSecurityType_old!=cloudAppSecurityType_new, "sessionControls.cloudAppSecurityType, ".cloudAppSecurityType_old.", ".cloudAppSecurityType_new, null()),
if(signInFrequencyValue_old!=signInFrequencyValue_new, "signInFrequency.value, ".signInFrequencyValue_old.", ".signInFrequencyValue_new, null())
)
| mvexpand changes
| rex field=changes "(?<key>[^,]+), (?<old_value>[^,]+), (?<new_value>.+)"
| table key, old_value, new_value

Re: Json object key value differences as output

ITWhisperer — Fri, 28 Feb 2025 12:40:33 GMT

Please post your raw event in a code block using the </> button so we can see what you are dealing with and be able to provide further guidance.

Re: Json object key value differences as output

vikashumble — Fri, 28 Feb 2025 12:46:56 GMT

Hello @kiran_panchavat

This does work if I the changed values are only in the fields I deleberatley changed values from. In other words, displayName, modifiedDateTime etc. BUt what I am looking for is if values are changed in any of this json object (say some events have changed values in id or something else). I think that would not be captured by your query (I have tested that). Hence I cannot accept this as a solution as of now

Re: Json object key value differences as output

livehybrid — Fri, 28 Feb 2025 13:00:22 GMT

hi @vikashumble

Let us know how you get on with the link I posted in my previous reply, or the suggestion from @ITWhisperer and then we can help tweak from there depending on the results 🙂

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Json object key value differences as output

vikashumble — Fri, 28 Feb 2025 13:08:22 GMT

Hello @ITWhisperer , below is the sample event. I am looking to compare "targetResources.modifiedProperties.oldValue" VS "targetResources.modifiedProperties.newValue". And if there are differences, then output the keyname, old value and new value. Hope this makes sense and apologies for confusion before

{ "id": "XXXXXX", "category": "ABCD", "correlationId": "exxxxxx0", "result": "success", "resultReason": null, "activityDisplayName": "update something", "activityDateTime": "2025-02-13T10:00:54.007809Z", "loggedByService": "XXXX", "operationType": "Update", "targetResources": [ { "id": "XXXX", "displayName": "DISPLAYNAME", "type": "ABCD", "userPrincipalName": null, "groupType": null, "modifiedProperties": [ { "displayName": "abcd", "oldValue": "{\"id\":\"1234\",\"displayName\":\"ANY DISPLAY NAME\",\"createdDateTime\":\"2022-10-05T10:01:58.275401+00:00\",\"modifiedDateTime\":\"2025-02-05T10:30:40.0351794+00:00\",\"state\":\"enabled\",\"conditions\":{\"applications\":{\"includeApplications\":[\"YYYY\"],\"excludeApplications\":[],\"includeUserActions\":[\"USERACTION1\"],\"includeAuthenticationContextClassReferences\":[],\"applicationFilter\":null},\"users\":{\"includeUsers\":[],\"excludeUsers\":[],\"includeGroups\":[\"USERGROUP1\",\"USERGROUP2\"],\"excludeGroups\":[],\"includeRoles\":[],\"excludeRoles\":[]},\"userRiskLevels\":[],\"signInRiskLevels\":[],\"clientAppTypes\":[\"all\"],\"servicePrincipalRiskLevels\":[]},\"grantControls\":{\"operator\":\"OR\",\"builtInControls\":[\"mfa\"],\"customAuthenticationFactors\":[],\"termsOfUse\":[]},\"sessionControls\":{\"cloudAppSecurity\":{\"cloudAppSecurityType\":\"monitorOnly\",\"isEnabled\":true},\"signInFrequency\":{\"value\":2,\"type\":\"hours\",\"authenticationType\":\"primaryAndSecondaryAuthentication\",\"frequencyInterval\":\"timeBased\",\"isEnabled\":true}}}", "newValue": "{\"id\":\"12345\",\"displayName\":\"ANY DISPLAY NAME 1\",\"createdDateTime\":\"2022-10-05T10:01:58.275401+00:00\",\"modifiedDateTime\":\"2025-02-06T10:30:40.0351794+00:00\",\"state\":\"enabled\",\"conditions\":{\"applications\":{\"includeApplications\":[\"AABB\"],\"excludeApplications\":[],\"includeUserActions\":[],\"includeAuthenticationContextClassReferences\":[],\"applicationFilter\":null},\"users\":{\"includeUsers\":[\"All\"],\"excludeUsers\":[],\"includeGroups\":[],\"excludeGroups\":[],\"includeRoles\":[],\"excludeRoles\":[]},\"userRiskLevels\":[],\"signInRiskLevels\":[],\"clientAppTypes\":[\"all\"],\"servicePrincipalRiskLevels\":[]},\"grantControls\":{\"operator\":\"OR\",\"builtInControls\":[\"mfa\"],\"customAuthenticationFactors\":[],\"termsOfUse\":[]},\"sessionControls\":{\"cloudAppSecurity\":{\"cloudAppSecurityType\":\"monitorOnly\",\"isEnabled\":true},\"signInFrequency\":{\"value\":1,\"type\":\"hours\",\"authenticationType\":\"primaryAndSecondaryAuthentication\",\"frequencyInterval\":\"timeBased\",\"isEnabled\":true}}}" } ] } ], "additionalDetails": [ { "key": "Category", "value": "ANY CATEGORY" } ] }@

Re: Json object key value differences as output

vikashumble — Fri, 28 Feb 2025 13:18:30 GMT

Hello @livehybrid

I am trying the solutions on the link provided by you. They are not working as it is as they compare the key rather than values and I am looking to compare the values and get the differences. I am trying to tweak them to see how can I do that. And yes, once I have the solution, I will add karma points and accept a solution as an answer. 🙂

Thanks

Re: Json object key value differences as output

ITWhisperer — Fri, 28 Feb 2025 14:41:01 GMT

Try something along these lines

| makeresults format=json data="[{ \"id\": \"XXXXXX\", \"category\": \"ABCD\", \"correlationId\": \"exxxxxx0\", \"result\": \"success\", \"resultReason\": null, \"activityDisplayName\": \"update something\", \"activityDateTime\": \"2025-02-13T10:00:54.007809Z\", \"loggedByService\": \"XXXX\", \"operationType\": \"Update\", \"targetResources\": [ { \"id\": \"XXXX\", \"displayName\": \"DISPLAYNAME\", \"type\": \"ABCD\", \"userPrincipalName\": null, \"groupType\": null, \"modifiedProperties\": [ { \"displayName\": \"abcd\", \"oldValue\": \"{\\\"id\\\":\\\"1234\\\",\\\"displayName\\\":\\\"ANY DISPLAY NAME\\\",\\\"createdDateTime\\\":\\\"2022-10-05T10:01:58.275401+00:00\\\",\\\"modifiedDateTime\\\":\\\"2025-02-05T10:30:40.0351794+00:00\\\",\\\"state\\\":\\\"enabled\\\",\\\"conditions\\\":{\\\"applications\\\":{\\\"includeApplications\\\":[\\\"YYYY\\\"],\\\"excludeApplications\\\":[],\\\"includeUserActions\\\":[\\\"USERACTION1\\\"],\\\"includeAuthenticationContextClassReferences\\\":[],\\\"applicationFilter\\\":null},\\\"users\\\":{\\\"includeUsers\\\":[],\\\"excludeUsers\\\":[],\\\"includeGroups\\\":[\\\"USERGROUP1\\\",\\\"USERGROUP2\\\"],\\\"excludeGroups\\\":[],\\\"includeRoles\\\":[],\\\"excludeRoles\\\":[]},\\\"userRiskLevels\\\":[],\\\"signInRiskLevels\\\":[],\\\"clientAppTypes\\\":[\\\"all\\\"],\\\"servicePrincipalRiskLevels\\\":[]},\\\"grantControls\\\":{\\\"operator\\\":\\\"OR\\\",\\\"builtInControls\\\":[\\\"mfa\\\"],\\\"customAuthenticationFactors\\\":[],\\\"termsOfUse\\\":[]},\\\"sessionControls\\\":{\\\"cloudAppSecurity\\\":{\\\"cloudAppSecurityType\\\":\\\"monitorOnly\\\",\\\"isEnabled\\\":true},\\\"signInFrequency\\\":{\\\"value\\\":2,\\\"type\\\":\\\"hours\\\",\\\"authenticationType\\\":\\\"primaryAndSecondaryAuthentication\\\",\\\"frequencyInterval\\\":\\\"timeBased\\\",\\\"isEnabled\\\":true}}}\", \"newValue\": \"{\\\"id\\\":\\\"12345\\\",\\\"displayName\\\":\\\"ANY DISPLAY NAME 1\\\",\\\"createdDateTime\\\":\\\"2022-10-05T10:01:58.275401+00:00\\\",\\\"modifiedDateTime\\\":\\\"2025-02-06T10:30:40.0351794+00:00\\\",\\\"state\\\":\\\"enabled\\\",\\\"conditions\\\":{\\\"applications\\\":{\\\"includeApplications\\\":[\\\"AABB\\\"],\\\"excludeApplications\\\":[],\\\"includeUserActions\\\":[],\\\"includeAuthenticationContextClassReferences\\\":[],\\\"applicationFilter\\\":null},\\\"users\\\":{\\\"includeUsers\\\":[\\\"All\\\"],\\\"excludeUsers\\\":[],\\\"includeGroups\\\":[],\\\"excludeGroups\\\":[],\\\"includeRoles\\\":[],\\\"excludeRoles\\\":[]},\\\"userRiskLevels\\\":[],\\\"signInRiskLevels\\\":[],\\\"clientAppTypes\\\":[\\\"all\\\"],\\\"servicePrincipalRiskLevels\\\":[]},\\\"grantControls\\\":{\\\"operator\\\":\\\"OR\\\",\\\"builtInControls\\\":[\\\"mfa\\\"],\\\"customAuthenticationFactors\\\":[],\\\"termsOfUse\\\":[]},\\\"sessionControls\\\":{\\\"cloudAppSecurity\\\":{\\\"cloudAppSecurityType\\\":\\\"monitorOnly\\\",\\\"isEnabled\\\":true},\\\"signInFrequency\\\":{\\\"value\\\":1,\\\"type\\\":\\\"hours\\\",\\\"authenticationType\\\":\\\"primaryAndSecondaryAuthentication\\\",\\\"frequencyInterval\\\":\\\"timeBased\\\",\\\"isEnabled\\\":true}}}\" } ] } ], \"additionalDetails\": [ { \"key\": \"Category\", \"value\": \"ANY CATEGORY\" } ] }]" | fields _raw | spath targetResources{}.modifiedProperties{} output=modifiedProperties | fields - _raw | spath input=modifiedProperties | eval newValueString="{\"newValueObject\":".newValue."]" | spath input=newValueString | foreach newValueObject.* [| eval _value=json_extract(oldValue,"<<MATCHSTR>>") | eval _KeyName=if('<<FIELD>>'=_value,null(),"<<MATCHSTR>>") | eval mismatch=if(isnotnull(_KeyName),if(isnotnull(mismatch),mvappend(mismatch,_KeyName."|"._value."|".'<<FIELD>>'),_KeyName."|"._value."|".'<<FIELD>>'),mismatch)] | fields - newValueObject.* newValueString _value _KeyName

You should end up with a multi-value field with pipe delimited values for key, old value, new value

Re: Json object key value differences as output

yuanliu — Sun, 02 Mar 2025 00:34:28 GMT

Thank you for illustrating the use case clearly with sample data, logic, and expected result from sample. But you also want to specify if Json1 and json2 are in the same row/event. Here is a solution if they are.

| table Json1 json2 | transpose 0 column_name=name | spath input="row 1" | fields - "row 1" | foreach *{} [eval <<MATCHSTR>>_array = mv_to_json_array('<<FIELD>>')] | fillnull value=null | fields - *{} | stats list(*) as * | foreach * [eval "<<FIELD>>" = if(mvcount(mvdedup('<<FIELD>>')) < 2, null(), '<<FIELD>>')] | transpose 0 column_name=KeyName | search "row 1" = * | eval KeyName = if(KeyName LIKE "%_array", replace(KeyName, "_array$", "{}"), KeyName) | eval "Old Value" = mvindex('row 1', 0), "New Value" = mvindex('row 1', 1) | fields - "row 1" | foreach *Value [eval <<FIELD>> = if('<<FIELD>>' != "null", '<<FIELD>>', if(KeyName LIKE "%{}", "[]", null()))]

Here is an emulation you can play with and compare with real data.

| makeresults | fields - _time | eval Json1 = "{ \"id\": \"XXXXX\", \"displayName\": \"ANY DISPLAY NAME\", \"createdDateTime\": \"2021-10-05T07:01:58.275401+00:00\", \"modifiedDateTime\": \"2025-02-05T10:30:40.0351794+00:00\", \"state\": \"enabled\", \"conditions\": { \"applications\": { \"includeApplications\": [ \"YYYYY\" ], \"excludeApplications\": [], \"includeUserActions\": [], \"includeAuthenticationContextClassReferences\": [], \"applicationFilter\": null }, \"users\": { \"includeUsers\": [], \"excludeUsers\": [], \"includeGroups\": [ \"USERGROUP1\", \"USERGROUP2\" ], \"excludeGroups\": [], \"includeRoles\": [], \"excludeRoles\": [] }, \"userRiskLevels\": [], \"signInRiskLevels\": [], \"clientAppTypes\": [ \"all\" ], \"servicePrincipalRiskLevels\": [] }, \"grantControls\": { \"operator\": \"OR\", \"builtInControls\": [ \"mfa\" ], \"customAuthenticationFactors\": [], \"termsOfUse\": [] }, \"sessionControls\": { \"cloudAppSecurity\": { \"cloudAppSecurityType\": \"monitor\", \"isEnabled\": true }, \"signInFrequency\": { \"value\": 1, \"type\": \"hours\", \"authenticationType\": \"primaryAndSecondaryAuthentication\", \"frequencyInterval\": \"timeBased\", \"isEnabled\": true } } }", json2 = "{ \"id\": \"XXXXX\", \"displayName\": \"ANY DISPLAY NAME 1\", \"createdDateTime\": \"2021-10-05T07:01:58.275401+00:00\", \"modifiedDateTime\": \"2025-02-06T10:30:40.0351794+00:00\", \"state\": \"enabled\", \"conditions\": { \"applications\": { \"includeApplications\": [ \"YYYYY\" ], \"excludeApplications\": [], \"includeUserActions\": [], \"includeAuthenticationContextClassReferences\": [], \"applicationFilter\": null }, \"users\": { \"includeUsers\": [], \"excludeUsers\": [], \"includeGroups\": [ \"USERGROUP1\", \"USERGROUP2\", \"USERGROUP3\" ], \"excludeGroups\": [ \"USERGROUP4\" ], \"includeRoles\": [], \"excludeRoles\": [] }, \"userRiskLevels\": [], \"signInRiskLevels\": [], \"clientAppTypes\": [ \"all\" ], \"servicePrincipalRiskLevels\": [] }, \"grantControls\": { \"operator\": \"OR\", \"builtInControls\": [ \"mfa\" ], \"customAuthenticationFactors\": [], \"termsOfUse\": [] }, \"sessionControls\": { \"cloudAppSecurity\": { \"cloudAppSecurityType\": \"block\", \"isEnabled\": true }, \"signInFrequency\": { \"value\": 2, \"type\": \"hours\", \"authenticationType\": \"primaryAndSecondaryAuthentication\", \"frequencyInterval\": \"timeBased\", \"isEnabled\": true } } }" ``` data emulation above ```

The above search gives

KeyName	New Value	Old Value
conditions.users.excludeGroups{}	["USERGROUP4"]	[]
conditions.users.includeGroups{}	["USERGROUP1","USERGROUP2","USERGROUP3"]	["USERGROUP1","USERGROUP2"]
displayName	ANY DISPLAY NAME 1	ANY DISPLAY NAME
modifiedDateTime	2025-02-06T10:30:40.0351794+00:00	2025-02-05T10:30:40.0351794+00:00
name	json2	Json1
sessionControls.cloudAppSecurity.cloudAppSecurityType	block	monitor
sessionControls.signInFrequency.value	2	1

For the life of me I cannot figure where does ModifiedDateTime differ. They look identical to me.
We can go more semantic with SPL but as you want the {} notation intact, this is perhaps the most direct.