This is a single server Splunk deployment. I am indexing Duo MFA logs using the official splunk app. In the "Searching and reporting" app, when I use the table command to view that data, each field is a multivalue field with the value duplicated. When I try the same search using the Duo app instead of "Searching and reporting", the fields are extracted only once as expected, not duplicated. For example... When I use the table command on this data in "Searching and reporting":     email user@example.com user@example.com       When I use the table command on this data in the "Duo" app:     email user@example.com       So this problem appears to be limited to the "Searching and reporting" app. But I'm not finding any configuration specific to "Searching and reporting" related to this app/source. For example, there is nothing in SPLUNK/etc/apps/search/local/ props.conf or transforms.conf that would affect this source. The current configuration according to the btool is coming from SPLUNK/etc/apps/duo_splunkapp/default/props.conf and is:     [source::duo] INDEXED_EXTRACTIONS = json KV_MODE = none       I also tried changing the config to this:     INDEXED_EXTRACTIONS = none AUTO_KV_JSON = true KV_MODE = json       but that just resulted in neither the "Searching and reporting" app nor the "Duo" app having extractions for this data. How do I fix this so the "Searching and reporting" app has a single set of extractions and not duplicates? ... View more

Looking at the example field below (part of a JSON event), I'm trying to figure out how at search time to pair up the corresponding values of properties.appliedConditionalAccessPolicies{}.displayName fields and properties.appliedConditionalAccessPolicies{}.result fields into new field/value pairs for each event (note that there can be multiple pairs per event - two in this example). So for example, in the event below, I would want to add two new field/value pairs to the event: Require_Duo_MFA=success Scammer_Blocked_IP_Addresses=notApplied Any ideas how to approach that?   appliedConditionalAccessPolicies: [ [-] { [-] conditionsNotSatisfied: 0 conditionsSatisfied: 3 displayName: Require Duo MFA enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: 11111111-1111-1111-1111-111111111111 result: success } { [-] conditionsNotSatisfied: 8 conditionsSatisfied: 3 displayName: Scammer Blocked IP Addresses enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: 22222222-2222-2222-2222-222222222222 result: notApplied } ]   ... View more

I'm having trouble extracting key/value pairs from a set of data. I think there are two separate problems that are making this difficult. The key/value data has redundant descriptors. For example rather than {"foo":"bar"} , the data looks like {"Name":"foo","Value":"bar"} . The data is sometimes coming in with the value before the key, e.g. {"Value":"bar","Name":"foo"} Each event also has several of these pairs (I'll include some examples below). I'm looking for a way to consistently extract from this data such that I get a new field (e.g. foo ) with the corresponding value (e.g. bar ) for each key/value pair in each event. _raw examples (data has been anonymized, but I haven't changed the structure): Key/Value: {"OrganizationName": "example.com", "Parameters": [{"Name": "Identity", "Value": "user@example.com"}, {"Name": "AccessRights", "Value": "ReadPermission"}, {"Name": "User", "Value": "Example-Username"}], "OrganizationId": "012-345-6789", "Operation": "Get-Something", "SessionId": "", "Workload": "Exchange", "CreationTime": "2018-10-12T22:08:13", "UserKey": "000011122233334445555", "ExternalAccess": false, "Version": 1, "Id": "00000000-0000-0000-0000-0000000000", "ObjectId": "targetusername", "ClientIP": "192.168.0.1:12345", "UserId": "admin@example.com", "RecordType": 1, "ResultStatus": "True", "UserType": 2, "OriginatingServer": "ABCD00000 (00.00.0000.000)"} Value/Key: {"OrganizationName": "example.com", "Parameters": [{"Value": "user@example.com", "Name": "Identity"}, {"Value": "Example-Username", "Name": "User"}, {"Value": "FullAccess", "Name": "AccessRights"}, {"Value": "All", "Name": "InheritanceType"}], "OrganizationId": "012-345-6789", "Operation": "Get-Something", "SessionId": "", "Workload": "Exchange", "CreationTime": "2018-10-12T22:08:13", "UserKey": "000011122233334445555", "ExternalAccess": false, "Version": 1, "Id": "00000000-0000-0000-0000-0000000000", "ObjectId": "targetusername", "ClientIP": "192.168.0.1:12345", "UserId": "admin@example.com", "RecordType": 1, "ResultStatus": "True", "UserType": 2, "OriginatingServer": "ABCD00000 (00.00.0000.000)"} How can I consistently extract all of the key/value pairs within "Parameters": [] ? ... View more