Multivalue field extraction from nested field

[b17gunnr]

Hello folks,

I have a series of event results which take the format as shown below:

   appDisplayName: foo
   appId: foo0
   appliedConditionalAccessPolicies: [ [-]
     { [-]
       displayName: All Users Require MFA All Apps
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo1
       result: success
     }
     { [-]
       displayName: macOS Conditional Access Policy
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo2
       result: success
     }
     { [-]
       displayName: Global-Restrict
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo3
       result: notApplied
     }
     { [-]
       displayName: All_user_risk_policy
       enforcedGrantControls: [ [+]
       ]
       enforcedSessionControls: [ [+]
       ]
       id: foo4
       result: notApplied

Is there a way to cycle through the specific event to extract and maintain the correlation of field:value and then repeat for one or more event blocks? Effectively it would look like this:

displayName: All Users Require MFA All Apps - id: foo1 - result: success

displayName: macOS Conditional Access Policy - id: foo2 - result: success

displayName: Global-Restrict - id: foo3 - result: notApplied

displayName: All_user_risk_policy - id: foo4 - result: notApplied

Thank you to all.

[ITWhisperer · Accepted solution]

| spath appliedConditionalAccessPolicies{} output=appliedConditionalAccessPolicies
| mvexpand appliedConditionalAccessPolicies
| spath input=appliedConditionalAccessPolicies

[b17gunnr]

This was it. Thank you for the assist.

[PickleRick]

Extract appliedConditionalAccessPolicies as a whole, expand the multivalued field, then extract each row separately.