Hello, I am looking to add a particular value to an existing search of Okta data. The problem is I don't know how to extract the value which is on the same level as other values. The value I am looking for is "Workflows Administrator". The existing search is: index=okta "debugContext.debugData.privilegeGranted"="*" | rename actor.displayName as "Actor", targetUserDisplayName as "Target Name", targetUserAlternateId as "Target ID", description as "Action", debugContext.debugData.privilegeGranted as "Role(s)" | eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | table Time, Actor, Action, "Target Name", "Target ID", Action, "Role(s)" and sample data is { [-]
actor: { [+]
}
authenticationContext: { [+]
}
client: { [+]
}
debugContext: { [-]
debugData: { [-]
privilegeGranted: Application administrator (all), User administrator (all), Help Desk administrator (all)
}
}
device: null
displayMessage: Grant user privilege
eventType: user.account.privilege.grant
legacyEventType: core.user.admin_privilege.granted
outcome: { [-]
reason: null
result: SUCCESS
}
published: 2025-05-08T19:30:54.612Z
request: { [-]
ipChain: [ [+]
]
}
securityContext: { [-]
asNumber: null
asOrg: null
domain: null
isProxy: null
isp: null
}
severity: INFO
target: [ [-]
{ [-]
alternateId: jdoe@company.com
detailEntry: null
displayName: John Doe
id: 00umfyv9jwzVvafI71t7
type: User
}
{ [-]
alternateId: unknown
detailEntry: null
displayName: Custom role binding added
id: CUSTOM_ROLE_BINDING_ADDED
type: CUSTOM_ROLE_BINDING_ADDED
}
{ [-]
alternateId: /api/v1/iam/roles/WORKFLOWS_ADMIN
detailEntry: null
displayName: Workflows Administrator
id: WORKFLOWS_ADMIN
type: CUSTOM_ROLE
}
{ [-]
alternateId: /api/v1/iam/resource-sets/WORKFLOWS_IAM_POLICY
detailEntry: null
displayName: Workflows Resource Set
id: WORKFLOWS_IAM_POLICY
type: RESOURCE_SET
}
]
transaction: { [+]
}
uuid: 2c42-11f0-a9fe
version: 0
} Any help is appreciated. Thank you!
... View more
