The following is a section of an larger JSON data source digested into our Splunk instance:
"identities": [{"issuerAssignedId": "bob.smith@gmail.com", "issuer": "domain.onmicrosoft.com", "signInType": "emailAddress"}, {"issuerAssignedId": "0023587453958742158@domain.onmicrosoft.com", "issuer": "domain.onmicrosoft.com", "signInType": "userPrincipalName"}]
The problem is this data ends up in three multi-valued fields:
identities{}.issuer
identities{}.issuerAssignedId
identities{}.signInType
I need to extract the "identities{}.issuerAssignedId" into their own fields as separate identities. Is this something that can be done at search time, or do I need to add a transform somewhere? If a transform is needed, what could that look like?
Thank you!
your search
| rename identities{}.* as *
| table issuer issuerAssignedId signInType
| eval counter=mvrange(0, mvcount(issuerAssignedId))
| mvexpand counter
| rename counter as _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _counter