Splunk Search

Multivalue field extraction from nested field

b17gunnr
Explorer

 

Hello folks,

I have a series of event results which take the format as shown below:

   appDisplayName: foo
   appId: foo0
   appliedConditionalAccessPolicies: [ [-]
     { [-]
       displayName: All Users Require MFA All Apps
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo1
       result: success
     }
     { [-]
       displayName: macOS Conditional Access Policy
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo2
       result: success
     }
     { [-]
       displayName: Global-Restrict
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo3
       result: notApplied
     }
     { [-]
       displayName: All_user_risk_policy
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo4
       result: notApplied

Is there a way to cycle through the specific event to extract and maintain the correlation of field:value and then repeat for one or more event blocks? Effectively it would look like this:

displayName: All Users Require MFA All Apps - id: foo1 - result: success

displayName: macOS Conditional Access Policy - id: foo2 - result: success

displayName: Global-Restrict - id: foo3 - result: notApplied

displayName: All_user_risk_policy - id: foo4 - result: notApplied

Thank you to all.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath appliedConditionalAccessPolicies{} output=appliedConditionalAccessPolicies
| mvexpand appliedConditionalAccessPolicies
| spath input=appliedConditionalAccessPolicies

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath appliedConditionalAccessPolicies{} output=appliedConditionalAccessPolicies
| mvexpand appliedConditionalAccessPolicies
| spath input=appliedConditionalAccessPolicies

b17gunnr
Explorer

This was it. Thank you for the assist.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Extract appliedConditionalAccessPolicies as a whole, expand the multivalued field, then extract each row separately.

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...