topic Re: Collect Command Creating Single Line Events and One Multi line Event in Knowledge Management

Collect Command Creating Single Line Events and One Multi line Event

mgagnaire — Fri, 09 Oct 2015 12:58:43 GMT

Hello,

I am having a bit of an issue with the collect command.
I'm trying to index an ldap search so i can use the data.
My ldap search is quite simple and it works well (i.e. it returns the expected results):

|ldapsearch search="(&(objectClass=computer)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2))" attrs="cn"

(I am getting the cn of every computer that is not disabled)

to this search, i am adding this so i can index the result in splunk:

|collect index=ldap_summary sourcetype=ldap:computeraccount

The indexing job works for the most part, but for a couple of hundreds of computer, it creates a single multi line event containing more than 200 events.

I cannot understand why it is doing this as i have tried the testmode attribute of the collect command, and the preview is correct: one single line events for every AD object.

Any help on the matter would be greatly appreciated.

Thank you.

Omar

Re: Collect Command Creating Single Line Events and One Multi line Event

mgagnaire — Tue, 13 Oct 2015 12:50:46 GMT

Hello,

I have finally found a workaround and the following is the workaround I used.

Just before the collect pipe, i stored the field that i wanted (here cn) in a table. The indexing result is composed of only single events (no more 300 hundred events in one) with info about the search and the table processing. At least i have my field and all the values i am interested in.

| ldapsearch search="(&(objectCategory=computer)(objectClass=user)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" attrs="cn" | table cn | collect index=ldap_summary sourcetype="ldap:computeraccount"

I am not sure why this works but it does.
I hope this can help someone in the future.

Regards,

Omar

Re: Collect Command Creating Single Line Events and One Multi line Event

proylea — Tue, 16 Jan 2018 23:14:46 GMT

Thanks Omar, that did help, I had individual events with the same time stamp getting processed by collect in multivalue events.
Your answer helped me find the workaround, I put
table _raw
before the collect and it has maintained single events.

Cheers