Hello, with version 9 this is a fromjson that makes the extraction easier     | datamodel | spath output=datamodel path=modelName | search datamodel!="Application_State" AND datamodel!="Change_Analysis" AND datamodel!="Splunk_CIM_Validation" AND datamodel!="Splunk_Audit" AND datamodel!="Identity_Management" | spath output=object path=objects{}.objectName | spath output=fields path=objects{}.fields{} | eval n=mvcount(fields) | sort 0 - n | table n datamodel object fields | mvexpand fields | table datamodel object fields | fromjson fields | fromjson comment | fields - fields, comment | sort 0 datamodel object fieldName | stats values(*) as * by datamodel object fieldName     ... View more

Please check version 2.2.0 on github as I don’t have a lab set up yet to test it ... View more

Hi, This is not available yet. Could you open an issue on github to get it implemented ... View more

Thanks for feedback At the moment the alert actions does not parse multivalue fields and convert them to strings. A work-around is to use mvexpand if you have only one multivalue field in the row. but I am going to implement the parsing of multivalue fields in order to make proper API request. ... View more

To create alerts in the hive based on Splunk searches you may have a look st https://github.com/remg427/misp42splunk Although meant to pull and push attributes in MISP you can easily connect to TH ... View more