This section provides an overview of the log lines visible in the ​Akamai MFA​ app for Splunk. It also provides a dictionary of data available in the logs, describing the content in each log field and its meaning.

For this integration, you need:

• Splunk Enterprise software. See the Splunk Enterprise Installation Manual.
• Splunk app version 8.1 and above.
• Logging-type integration with ​Akamai MFA​. Follow the Splunk adapter
  instructions to integrate.

Authentication events

The authentication events logs are JSON-formatted at the source and composed of key-value pairs, where the value is a string or a dictionary of a key-value pair. Fields in the Splunk logs lines appear in a certain order.

Here you can see an example of the authentication events log lines in the ​Akamai MFA​ Splunk app.

{“uuid": "aud_JfNqdl6zSByrU0ovrbJ6m", "created_at": "2021-03-23T19:36:20.047688", "browser_ip": "49.207.58.115", "app_id":"app_3IyJXh2U9Jiws6bvxcf8X", “app_name”: “Test Application”,"device": "push", "auth_method": "push", "user_id":"user_6Hy1v24DZIr8b0UHYi5dv3", "username": "nityagi", "is_success": true, "device_metadata": "Android", "receipt": "", "browser_type": "Chrome", "browser_version": "88.0.4324", "browser_os": "MacOS", "browser_os_version": "10.15.7", "device_os": "android", "device_os_version": "10.0.0", "browser_geo_location": "BANGALORE KA, IN", "device_geo_location": "BANGALORE KA, IN", "device_ip": "49.207.58.115”,“denial_type”: null“device_id”: “device_3kbTGOPbHxH3KfYkPzm31e”, “policy_attr_name”: null, “policy_uuid”: null,“principal_type”: null,“principal_uuid”: null}

The following table describes JSON keys for the authentication events that are pushed to Splunk, the sequence of fields in the Splunk log lines, and explains the content of these fields.

Session history

The session history logs are JSON-formatted at the source and composed of key-value pairs, where the value is a string or a dictionary of a key-value pair. Fields in the Splunk logs lines appear in a certain order.

Here you can see an example of the session history log lines in the ​Akamai MFA​ Splunk app.

{"started_at": "2025-10-09T05:42:14.760458Z", "ended_at": "2025-10-09T05:42:30.342548Z", "session_id": "session_6XeoBhO6mnAH0WMuLTINO3", "outcome": "success", "app": {"id": "app_2Zm4nmF7OPiK87cD4P2Vly", "name": "phone_only", "app_type": "demo"}, "provided_username": "mfa_user", "user_id": "user_2PVk0rPac6BHnc46kix563", "endpoint": {"geo_country": "US", "geo_state_or_province": "QUINCY WA, US", "ip": "127.0.0.1", "browser_type": "Chrome", "browser_version": "141.0.0", "os": "Linux", "os_version": "5.4.0"}, "attempts_started": 2, "attempts_concluded": 1, "attempts_succeeded": 1, "attempts_failed": 0, "last_incomplete_attempt": {"attempt_id": "attempt_5Zur8hWnqgthIv5NCOvJV9", "started": {"time": "2025-10-09T05:42:16.253138", "user_id": "user_2PVk0rPac6BHnc46kix563", "auth_method": "text_code", "intent": "login"}, "concluded": null}, "last_failed_attempt": null, "last_successful_attempt": {"attempt_id": "attempt_996HVkYl4h28RFeSzfKurp", "started": {"time": "2025-10-09T05:42:25.690508", "user_id": "user_2PVk0rPac6BHnc46kix563", "auth_method": "text_code", "intent": "login"}, "concluded": {"concluded": {"time": "2025-10-09T05:42:30.342548Z", "user_id": "user_2PVk0rPac6BHnc46kix563", "success": true, "auth_method": "text_code", "intent": "login"}}}, "distinct_policies_used": 1, "policies": {"policy_1": {"policy_id": "policy_7NE52CkKuyAh9hZhSa3NMK", "policy_name": null, "principal_type": "Tenant", "caveat": null}}}

The following table describes JSON keys for the session history events that are pushed to Splunk, the sequence of fields in the Splunk log lines, and explains the content of these fields.

Resource actions

The resource action logs are JSON-formatted at the source and composed of key-value pairs, where the value is a string or a dictionary of a key-value pair. Fields in the Splunk logs lines appear in a certain order. These logs let you audit admin events.

Here you can see an example of the resource action log lines in the ​Akamai MFA​ Splunk app.

{"time": "2025-10-08T21:41:39.602221Z", "uuid": "aud_3ZzFdAEddSCammrBYfwZwG", "actor_name": "nsmith", "actor_role": "admin", "resource_type": "integration", "resource_id": "app_2Zm4nmF7OPiK87cD4P2Vly", "resource_name": "MFA_UI_101010100", "action": "delete", "path_and_query": "/api/v1/control/applications/app_2Zm4nmF7OPiK87cD4P2Vly", "http_method": "delete", "request_id": "2kh520fz-c8fy-47fh-b5r5-70477ci767d9", "user_id": "", "resource_state": "{\"id\": \"app_2Zm4nmF7OPiK87cD4P2Vly\", \"name\": \"MFA_UI_101010100\", \"app_type\": \"generic_oidc\", \"created_at\": \"2025-10-08T21:40:00.508165\", \"deleted_at\": \"2025-10-08T21:41:39.584469Z\", \"is_enabled\": true, \"updated_at\": \"2025-10-08T21:41:39.615258\", \"username_modification\": {\"strategy\": \"no_modify\"}}"}

The following table describes JSON keys for the resource action events that are pushed to Splunk, the sequence of fields in the Splunk log lines, and explains the content of these fields.

Splunk fields extraction

As all the log lines are JSON-formatted from the source, there is no need to extract fields separately. Log lines will appear automatically in the search as soon as the logs are pushed.