I'm really stucked right now on my configuration for my json data below.   I'm currently building a data collector app in Splunk Add-on Builder. Here's the current configuration   My goal is to break the Integration_Business_Process_Events_group sub values into another event but should retain parent event details. So instead of having 1 event, I should have 6 events.   Hope for your answers. I already look into to the other similar problem like this by I'm getting more confuse.   Thanks everyone! ... View more