https://community.splunk.com/t5/Getting-Data-In/Multiple-Fields-with-Same-Name/m-p/209066#M41168 <P>You would need to configure multi-value field extraction (not done by default) to capture all values of OU, using either of these methods</P> <P>Fields.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields">https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields</A></P> <P>Props/Transforms.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Handling_events_with_multivalue_fields">https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Handling_events_with_multivalue_fields</A></P> Tue, 02 Aug 2016 14:21:36 GMT somesoni2 2016-08-02T14:21:36Z https://community.splunk.com/t5/Getting-Data-In/Multiple-Fields-with-Same-Name/m-p/209064#M41166 <P>I am importing AD data which can contain multiple Organizational Units (OU). Splunk only creates a field for the first instance, therefore I cannot query on all OUs.</P> <P>For example, this is my sample input data<BR /> sn = D'Arrigo<BR /> givenName = Frank<BR /> department = Information Technology<BR /> sAMAccountName = fdarrigo<BR /> EmailAddress = <A href="mailto:fdarrigo@nyaaa.com" target="_blank">fdarrigo@nyaaa.com</A><BR /> Enabled = True<BR /> LastLogonDate = 8/1/2016 9=49=40 PM<BR /> DistinguishedName = D'Arrigo Frank<BR /> OU=USB_Enabled<BR /> OU=User_Accounts<BR /> DC=nyaaa<BR /> DC=com<BR /> DC=com</P> <P>Notice, I have two OUs: USB_Enabled; User_Accounts</P> <P>I am looking for suggestions what allow me query using either/both OU as a filter.<BR /> index=myindex sourcetype=mysourcetype OU=USB_Enabled AND OU=User_Accounts</P> <P>Am I better off combining all OU values as a single MV field? (i.e. OU=USB_Enabled,User_Accounts)</P> Tue, 29 Sep 2020 10:30:01 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-Fields-with-Same-Name/m-p/209064#M41166 fdarrigo 2020-09-29T10:30:01Z https://community.splunk.com/t5/Getting-Data-In/Multiple-Fields-with-Same-Name/m-p/209065#M41167 <P>I would recommend having a multi-valued field for <CODE>OU</CODE> since you can manipulate the field easier and won't have to explicitly call each field. </P> <P>So for example if you wanted the top values of <CODE>OU</CODE> from 10-11am yesterday, then your search would look like this </P> <P><CODE>index=whatever OU="*" | top OU</CODE></P> <P>Which would produce an output like this </P> <P>OU_Name Count Percent </P> <P>But if you had a single valued field then your search and output would look like this </P> <P><CODE>index=whatever OU="*" OU1="*" | top OU</CODE></P> <P>OU_Name Count Percent OU1_Name Count Percent </P> Tue, 29 Sep 2020 10:27:28 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-Fields-with-Same-Name/m-p/209065#M41167 skoelpin 2020-09-29T10:27:28Z https://community.splunk.com/t5/Getting-Data-In/Multiple-Fields-with-Same-Name/m-p/209066#M41168 <P>You would need to configure multi-value field extraction (not done by default) to capture all values of OU, using either of these methods</P> <P>Fields.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields">https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields</A></P> <P>Props/Transforms.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Handling_events_with_multivalue_fields">https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Handling_events_with_multivalue_fields</A></P> Tue, 02 Aug 2016 14:21:36 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-Fields-with-Same-Name/m-p/209066#M41168 somesoni2 2016-08-02T14:21:36Z