I tried this solution, but it did not work for me... the output I am getting is coming from OpenAI via API, not sure if that is the problem.   The Output I get is one block of text, not retendered as HTML and without brake lines.  If I use <prep> </prep>  then I can see the text formatted as plain text, but I need it to be in HTML so it can have the proper markdowns. If you have any suggestions, it would be appreciated. Thanks. ... View more

Worked for me too , Thankyou very much. ... View more

Works on one of the members as well. I had a replication issue with one of the members, did the steps outlined here (on the member, not the captain) and it fixed it!  Thanks! @mintughosh ! 🙂 ... View more

Fixed it for me too - odd issue. ran this search index=_internal component=AuthorizationManager and created the missing roles with no capabilites and the page loaded straight away Thanks! ... View more

Glad to help you. Yes, first I have tried with mvzip but I got just first value & other values removed from results. I'm not suggesting mvexpand command if you have heavy JSON events because it has its own limitation. So I've used here stats commands to make avail all possible multivalued fields. Well here spath works well for us. if you execute this search up to stats command you will get another JSON. Eg, this search. YOUR_SEARCH | spath Projects{} output=Projects | stats count by FirstName LastName Projects After the stats by FirstName LastName Projects I will get JSON in Projects fields. This JSON field will work for as raw event for next spath command. Checkout this. | eval _raw=Projects So spath will enough for us to go deeper in JSON. I hope you this will help you and I'm sure you will try it with different types of JSON. Thanks Happy Splunking ... View more

@ktwingstrom, if your issue is different from the one posted here, you should post a new question with details of your requirement, mock screenshot of the output, masked sample data and what you have done so far, so that community members can assist. ... View more

Is there a way to accomplish this same principle in a props file? I've got JSON data that has a return{} field that has a big list of software that needs to be updated. But splunk is auto extracting each software name out as part of the field name. I want to do the same thing the OP did and rename all fields called Return* as something else. Can this be done in a conf file? Thanks ... View more