when that should have produced a proper JSON output.
| makeresults | eval _raw="{\"Target\":[{\"ID\":\"User_147b1c0b-5066-46e1-a0fe-12e7ca52494c\",\"Type\":2},{\"ID\":\"147b1c0b-5066-46e1-a0fe-12e7ca52494c\",\"Type\":2},{\"ID\":\"User\",\"Type\":2},{\"ID\":\"jenn@splunko365.com\",\"Type\":5},{\"ID\":\"10037FFEAE8FE859\",\"Type\":3}],\"OrganizationId\":\"aca24088-bb0e-42c4-a9a0-0099c3f962f0\",\"RecordType\":8,\"ActorContextId\":\"aca24088-bb0e-42c4-a9a0-0099c3f962f0\",\"Workload\":\"AzureActiveDirectory\",\"ExtendedProperties\":[{\"Value\":\"Success\",\"Name\":\"resultType\"},{\"Value\":\"UserManagement\",\"Name\":\"auditEventCategory\"},{\"Value\":\"<null>\",\"Name\":\"nCloud\"},{\"Value\":\"aca24088-bb0e-42c4-a9a0-0099c3f962f0\",\"Name\":\"actorContextId\"},{\"Value\":\"b3a0e779-9348-492e-8864-3dffd59e1be8\",\"Name\":\"actorObjectId\"},{\"Value\":\"User\",\"Name\":\"actorObjectClass\"},{\"Value\":\"john@splunko365.com\",\"Name\":\"actorUPN\"},{\"Value\":\"1003BFFDAEA5811F\",\"Name\":\"actorPUID\"},{\"Value\":\"MSODS.\",\"Name\":\"teamName\"},{\"Value\":\"aca24088-bb0e-42c4-a9a0-0099c3f962f0\",\"Name\":\"targetContextId\"},{\"Value\":\"147b1c0b-5066-46e1-a0fe-12e7ca52494c\",\"Name\":\"targetObjectId\"},{\"Value\":\"User\",\"Name\":\"extendedAuditEventCategory\"},{\"Value\":\"jenn@splunko365.com\",\"Name\":\"targetUPN\"},{\"Value\":\"10037FFEAE8FE859\",\"Name\":\"targetPUID\"},{\"Value\":\"[\\\"StrongAuthenticationRequirement\\\",\\\"TargetId.UserType\\\"]\",\"Name\":\"targetIncludedUpdatedProperties\"},{\"Value\":\"[{\\\"Name\\\":\\\"StrongAuthenticationRequirement\\\",\\\"OldValue\\\":[],\\\"NewValue\\\":[{\\\"RelyingParty\\\":\\\"*\\\",\\\"State\\\":1,\\\"RememberDevicesNotIssuedBefore\\\":\\\"2018-11-08T19:37:42.7363619Z\\\"}]},{\\\"Name\\\":\\\"Included Updated Properties\\\",\\\"OldValue\\\":null,\\\"NewValue\\\":\\\"StrongAuthenticationRequirement\\\"},{\\\"Name\\\":\\\"TargetId.UserType\\\",\\\"OldValue\\\":null,\\\"NewValue\\\":\\\"Member\\\"}]\",\"Name\":\"targetUpdatedProperties\"},{\"Value\":\"e180c62a-db41-43b9-ae6c-de0857210130\",\"Name\":\"correlationId\"},{\"Value\":\"2\",\"Name\":\"version\"},{\"Value\":\"{\\\"UserType\\\":\\\"Member\\\"}\",\"Name\":\"additionalDetails\"},{\"Value\":\"2.1\",\"Name\":\"env_ver\"},{\"Value\":\"#Ifx.AuditSchema#IfxMsods.AuditCommonEvent\",\"Name\":\"env_name\"},{\"Value\":\"2018-11-08T19:37:43.1158911Z\",\"Name\":\"env_time\"},{\"Value\":\"32YYA\",\"Name\":\"env_epoch\"},{\"Value\":\"61578266\",\"Name\":\"env_seqNum\"},{\"Value\":\"0\",\"Name\":\"env_popSample\"},{\"Value\":\"ikey\",\"Name\":\"env_iKey\"},{\"Value\":\"257\",\"Name\":\"env_flags\"},{\"Value\":\"##00000000-0000-0000-0000-000000000000_00000000-0000-0000-0000-000000000000_00000000-0000-0000-0000-000000000000\",\"Name\":\"env_cv\"},{\"Value\":\"<null>\",\"Name\":\"env_os\"},{\"Value\":\"<null>\",\"Name\":\"env_osVer\"},{\"Value\":\"becwebservice\",\"Name\":\"env_appId\"},{\"Value\":\"1.0.10571.2\",\"Name\":\"env_appVer\"},{\"Value\":\"1.0\",\"Name\":\"env_cloud_ver\"},{\"Value\":\"MSO-BL2\",\"Name\":\"env_cloud_name\"},{\"Value\":\"becwebservice\",\"Name\":\"env_cloud_role\"},{\"Value\":\"1.0.10571.2\",\"Name\":\"env_cloud_roleVer\"},{\"Value\":\"BL2BWSR573\",\"Name\":\"env_cloud_roleInstance\"},{\"Value\":\"PROD\",\"Name\":\"env_cloud_environment\"},{\"Value\":\"R5\",\"Name\":\"env_cloud_deploymentUnit\"}],\"UserId\":\"john@splunko365.com\",\"UserType\":0,\"TargetContextId\":\"aca24088-bb0e-42c4-a9a0-0099c3f962f0\",\"ResultStatus\":\"Success\",\"ObjectId\":\"jenn@splunko365.com\",\"Version\":1,\"ActorIpAddress\":\"<null>\",\"AzureActiveDirectoryEventType\":1,\"Operation\":\"Update user.\",\"Actor\":[{\"ID\":\"john@splunko365.com\",\"Type\":5},{\"ID\":\"1003BFFDAEA5811F\",\"Type\":3},{\"ID\":\"User_b3a0e779-9348-492e-8864-3dffd59e1be8\",\"Type\":2},{\"ID\":\"b3a0e779-9348-492e-8864-3dffd59e1be8\",\"Type\":2},{\"ID\":\"User\",\"Type\":2}],\"Id\":\"28a59b0b-1792-4bee-bcc7-a48ad68302a3\",\"ClientIP\":\"<null>\",\"CreationTime\":\"2018-11-08T19:37:43\",\"UserKey\":\"1003BFFDAEA5811F@splunko365.com\"}"
| jmespath output=ExtendedProperties.targetUpdatedProperties.* "ExtendedProperties[?Name=='targetUpdatedProperties'].Value|from_string(@[0])|[0]"
| table ExtendedProperties.targetUpdatedProperties.NewValue
Still seeing output like this:
{u'RememberDevicesNotIssuedBefore': u'2018-11-08T19:37:42.7363619Z', u'State': 1, u'RelyingParty': u'*'}when that should have produced a proper JSON output.
Example search