Multiple Fields with Same Name

[fdarrigo]

I am importing AD data which can contain multiple Organizational Units (OU). Splunk only creates a field for the first instance, therefore I cannot query on all OUs.

For example, this is my sample input data
sn = D'Arrigo
givenName = Frank
department = Information Technology
sAMAccountName = fdarrigo
EmailAddress = [email protected]
Enabled = True
LastLogonDate = 8/1/2016 9=49=40 PM
DistinguishedName = D'Arrigo Frank
OU=USB_Enabled
OU=User_Accounts
DC=nyaaa
DC=com
DC=com

Notice, I have two OUs: USB_Enabled; User_Accounts

I am looking for suggestions what allow me query using either/both OU as a filter.
index=myindex sourcetype=mysourcetype OU=USB_Enabled AND OU=User_Accounts

Am I better off combining all OU values as a single MV field? (i.e. OU=USB_Enabled,User_Accounts)

[somesoni2]

You would need to configure multi-value field extraction (not done by default) to capture all values of OU, using either of these methods

Fields.conf
https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields

Props/Transforms.conf
https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextrac...

[skoelpin · Accepted solution]

I would recommend having a multi-valued field for OU since you can manipulate the field easier and won't have to explicitly call each field.

So for example if you wanted the top values of OU from 10-11am yesterday, then your search would look like this

index=whatever OU="*" | top OU

Which would produce an output like this

OU_Name Count Percent

But if you had a single valued field then your search and output would look like this

index=whatever OU="*" OU1="*" | top OU

OU_Name Count Percent OU1_Name Count Percent