Getting Data In

How to extract multivalue identity fields into their own identities

cpalicensing
New Member

The following is a section of an larger JSON data source digested into our Splunk instance:

"identities": [{"issuerAssignedId": "bob.smith@gmail.com", "issuer": "domain.onmicrosoft.com", "signInType": "emailAddress"}, {"issuerAssignedId": "0023587453958742158@domain.onmicrosoft.com", "issuer": "domain.onmicrosoft.com", "signInType": "userPrincipalName"}]

The problem is this data ends up in three multi-valued fields:

identities{}.issuer
identities{}.issuerAssignedId
identities{}.signInType

I need to extract the "identities{}.issuerAssignedId" into their own fields as separate identities. Is this something that can be done at search time, or do I need to add a transform somewhere? If a transform is needed, what could that look like?

Thank you!

0 Karma

to4kawa
SplunkTrust
SplunkTrust
your search
| rename identities{}.* as *
| table issuer issuerAssignedId signInType
| eval counter=mvrange(0, mvcount(issuerAssignedId))
| mvexpand counter
| rename counter as _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _counter
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!