Splunk Apps » Lookup Editor

This is little complicated.

I have to flatten the dictionary such since the KV schema supports hierarchy. The problem is when a field contains JSON but the JSON is to be stored within the field, not flattened.

Here is some raw input:

[(u'name', u'Test'), (u'configuration.views', [{u'name': u'access_anomalies', u'app': u'DA-ESS-AccessProtection'}, {u'name': u'account_management', u'app': u'DA-ESS-AccessProtection'}, {u'name': u'incident_review', u'app': u'SA-ThreatIntelligence'}]), (u'configuration.hide_chrome', True), (u'configuration.delay', 300), (u'configuration.invert_colors', True), (u'configuration.delay_readable', u'5m'), (u'_user', u'nobody'), (u'_key', u'123456789')]

This parses to:

{
   "name":"Test",
   "configuration":{
      "views":[
         {
            "name":"access_anomalies",
            "app":"DA-ESS-AccessProtection" 
         },
         {
            "name":"account_management",
            "app":"DA-ESS-AccessProtection" 
         },
         {
            "name":"incident_review",
            "app":"SA-ThreatIntelligence" 
         }
      ],
      "delay":300,
      "delay_readable":"5m",
      "hide_chrome":true,
      "invert_colors":true
   },
   "_user":"nobody",
   "_key":"123456789" 
}

However, some of these should be left as raw content.

I have this loading, but it won't save.

This seems to be working now.