Getting Data In

How to extract multivalue identity fields into their own identities

cpalicensing
New Member

The following is a section of an larger JSON data source digested into our Splunk instance:

"identities": [{"issuerAssignedId": "bob.smith@gmail.com", "issuer": "domain.onmicrosoft.com", "signInType": "emailAddress"}, {"issuerAssignedId": "0023587453958742158@domain.onmicrosoft.com", "issuer": "domain.onmicrosoft.com", "signInType": "userPrincipalName"}]

The problem is this data ends up in three multi-valued fields:

identities{}.issuer
identities{}.issuerAssignedId
identities{}.signInType

I need to extract the "identities{}.issuerAssignedId" into their own fields as separate identities. Is this something that can be done at search time, or do I need to add a transform somewhere? If a transform is needed, what could that look like?

Thank you!

0 Karma

to4kawa
Ultra Champion
your search
| rename identities{}.* as *
| table issuer issuerAssignedId signInType
| eval counter=mvrange(0, mvcount(issuerAssignedId))
| mvexpand counter
| rename counter as _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _counter
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...