Hello, Can someone pls guide how to extract a multi value field called "GroupName" from my JSON data via the Field extractor IFX. The different values are seperated by ",\" as you can see in the ra...
See more...
Hello, Can someone pls guide how to extract a multi value field called "GroupName" from my JSON data via the Field extractor IFX. The different values are seperated by ",\" as you can see in the raw events. By default it only extracts the 1st value - . Raw events:
{"LogTimestamp": "Mon May 30 06:27:07 2022",[],"SAMLAttributes": "{\"FirstName\":[\"John\"],\"LastName\":[\"Doe\"],\"Email\":[\"John.doe@mycompany.com\"],\"DepartmentName\":[\"Group1-AVALON\"],\"GroupName\":[\"ZPA_Vendor_Azure_All\",\"Zscaler Proxy Users\",\"NewRelic_FullUser\",\"jira-users\",\"AWS-SSO-lstech-viewonly-users\",\"All Workers\"],\"userAccount\":[\"Full Time\"]
Regex generated by the IFX causes GroupName to have only 1 value: "ZPA_Vendor_Azure_All". I want it to display the other values also such as : Zscaler Proxy Users , NewRelic_FullUser , jira-users , AWS-SSO-lstech-viewonly-users, All Workers . The end of the different values of GroupName field is just before the "userAccount" field. Hope i am clear