Splunk Search

How to rekey or merge consecutive json key : value pairs into a field?

Glasses
Builder

So I have the following _json event that I need to wrangle into a more useful format.
As you can see there are 2 key:value pairs that are related, e.g name = and value =

For example I would like to combine the following into 1 field like a re-key, but do it globally for the entire source.

name: target_user
value: rey.skywalker@jedi.com

name:target_user,value: rey.skywalker@jedi.com or target_user= rey.skywalker@jedi.com

any suggestions appreciated, I tried a props and transforms on the search head with no luck.... thx in advance

{ [-]
actor: { [-]
email: kilo.ren@sith.com
profileId: 100
}
etag: "abcd1234"
events: [ [-]
{ [-]
name: edit
parameters: [ [-]
{ [-]
boolValue: false
name: primary_event
}
{ [-]
boolValue: true
name: billable
}
{ [-]
name: doc_id
value: jakjd446532
}
{ [-]
name: doc_type
value: pdf
}
{ [-]
name: doc_title
value: Overview.pdf
}
{ [-]
name: visibility
value: shared_externally
}
{ [-]
name: owner
value: kilo.ren@sith.com
}
{ [-]
boolValue: false
name: owner_is_shared_drive
}
{ [-]
boolValue: false
name: owner_is_team_drive
}
]
type: access
}
{ [-]
name: change_user_access
parameters: [ [-]
{ [-]
boolValue: true
name: primary_event
}
{ [-]
boolValue: true
name: billable
}
{ [-]
name: visibility_change
value: external
}
{ [-]
name: target_user
value: rey.skywalker@jedi.com
}
{ [-]
multiValue: [ [+]
]
name: old_value
}
{ [-]
multiValue: [ [+]
]
name: new_value
}
{ [-]
name: old_visibility
value: private
}
{ [-]
name: doc_id
value: 1d8546542318
}
{ [-]
name: doc_type
value: pdf
}
{ [-]
name: doc_title
value: Overview.pdf
}
{ [-]
name: visibility
value: shared_externally
}
{ [-]
name: owner
value: kilo.ren@sith.com
}
{ [-]
boolValue: false
name: owner_is_shared_drive
}
{ [-]
boolValue: false
name: owner_is_team_drive
}
]
type: acl_change
}
]
id: { [-]
applicationName: drive
customerId: abcd1234
time: 2020-01-12T18:42:34.543Z
uniqueQualifier: 123456
}
kind: admin#reports#activity
}
Show as raw text

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...