How to extract multivalue identity fields into their own identities

[cpalicensing]

The following is a section of an larger JSON data source digested into our Splunk instance:

"identities": [{"issuerAssignedId": "[email protected]", "issuer": "domain.onmicrosoft.com", "signInType": "emailAddress"}, {"issuerAssignedId": "[email protected]", "issuer": "domain.onmicrosoft.com", "signInType": "userPrincipalName"}]

The problem is this data ends up in three multi-valued fields:

identities{}.issuer
identities{}.issuerAssignedId
identities{}.signInType

I need to extract the "identities{}.issuerAssignedId" into their own fields as separate identities. Is this something that can be done at search time, or do I need to add a transform somewhere? If a transform is needed, what could that look like?

Thank you!

[to4kawa]

your search
| rename identities{}.* as *
| table issuer issuerAssignedId signInType
| eval counter=mvrange(0, mvcount(issuerAssignedId))
| mvexpand counter
| rename counter as _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _counter