We are using the Splunk Shibboleth add on app but unfortunately our Shib audit events are formatted as JSON and it's nullifying the audit fields in the transforms.conf file:
[shibboleth:audit-fields]
DELIMS = "|"
FIELDS = auditEventTime,requestBinding,requestId,relyingPartyId,messageProfileId,assertingPartyId,responseBinding,responseId,principalName,authNMethod,releasedAttributeId1,releasedAttributeId2,nameIdentifier,assertion1ID,assertion2ID
All of the K/V pairs that should be parsed are in the 'Event' field in the JSON formatted event with the | delimiter.
Is there a way to modify the transforms.conf file so that it looks in the Event field for the values to parse?
To turn off automatic JSON interpretation, do this on your search head:
[shibboleth:audit-fields]
KV_MODE = none
AUTO_KV_JSON = false