Incidentally – I figured this approach out after dealing with multivalue fields in JSON data sent by ForeScout CounterACT :: and needing to break them apart ?
June 03, 2020 at 12:26PM
via reddit https://www.reddit.com/r/Splunk/comments/gt6by8/alerting_on_last_specific_action/fsrf0ky?utm_source=ifttt