The cloudtrail event exports are in JSON with fields, which is great. However, each event has a top level empty piece to the structure that forces you to expand the entire event when looking at it in the gui (the + symbol). It also makes searching on fields incredibly difficult.
Is there some app or way to remove that parent level JSON bit with Splunk itself as it ingests? Currently we do it with a python script, but it takes forever to decompress, parse and the compress again.
