Before anything, let me first say that when you post JSON event sample, always use "Show raw text" before copying. This helps others help you. Secondly, as @bowesmana says, it is really unclear what you are asking. You already know the value "Workflows Administrator". Do you mean to search for this value and display other related key-value pairs? Or do you mean there are other possible values from the 3rd array element of target[] that you want to know how to reach that correct array element? If former, you need to specify which key-value pairs in that element are of interest. If latter, there are many ways, including a method that does not do "extracting" because Splunk by default has done that for you. But before doing that, you need to use Splunk's flattened-structure notation, not invented names like targetUserDisplayName. (Splunk's notation is target{}.displayName for this one.) Anyway, assuming the latter, @bowesmana already showed you several ways. Here I first present a formulae approach to reach every JSON array node in SPL: spath + mvexpand. But before I show any code, you need to perform the most critical task: to understand how that element is different from other elements in the same array, all of them having a key displayName. In order to make this determination, you need to carefully study the data. The differentiating factor among those elements is the JSON key type in that array. So, you would be looking for the element whose type is CUSTOM_ROLE. index=okta "debugContext.debugData.privilegeGranted"="*"
| fields - target{}.*
| spath path=target{}
| mvexpand target{}
| spath input=target{}
| where type == "CUSTOM_ROLE"
| rename actor.displayName as "Actor", displayName as "Target Name",
alternateId as "Target ID", description as "Action",
debugContext.debugData.privilegeGranted as "Role(s)"
| table Time, Actor, Action, "Target Name", "Target ID", Action, "Role(s)" With this approach, you can handle any JSON array. If you don't want to (re)extract everything in the array - there are occasions when mvexpand can be too expensive, here is a quirky method that can do the same thing: capture the value of target{}.displayName and target{}.alternateId corresponding to target{}.type of CUSTOM_ROLE. index=okta "debugContext.debugData.privilegeGranted"="*"
| eval type_index = mvfind('target{}.type', "CUSTOM_ROLE")
| eval "Target Name" = mvindex('target{}.displayName', type_index)
| eval "Target ID" = mvindex('target{}.alternateId', type_index)
| rename actor.displayName as "Actor", description as "Action",
debugContext.debugData.privilegeGranted as "Role(s)"
| table Time, Actor, Action, "Target Name", "Target ID", Action, "Role(s)"
... View more
