Getting Data In

Multiple Fields with Same Name

fdarrigo
Path Finder

I am importing AD data which can contain multiple Organizational Units (OU). Splunk only creates a field for the first instance, therefore I cannot query on all OUs.

For example, this is my sample input data
sn = D'Arrigo
givenName = Frank
department = Information Technology
sAMAccountName = fdarrigo
EmailAddress = fdarrigo@nyaaa.com
Enabled = True
LastLogonDate = 8/1/2016 9=49=40 PM
DistinguishedName = D'Arrigo Frank
OU=USB_Enabled
OU=User_Accounts
DC=nyaaa
DC=com
DC=com

Notice, I have two OUs: USB_Enabled; User_Accounts

I am looking for suggestions what allow me query using either/both OU as a filter.
index=myindex sourcetype=mysourcetype OU=USB_Enabled AND OU=User_Accounts

Am I better off combining all OU values as a single MV field? (i.e. OU=USB_Enabled,User_Accounts)

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

I would recommend having a multi-valued field for OU since you can manipulate the field easier and won't have to explicitly call each field.

So for example if you wanted the top values of OU from 10-11am yesterday, then your search would look like this

index=whatever OU="*" | top OU

Which would produce an output like this

OU_Name Count Percent

But if you had a single valued field then your search and output would look like this

index=whatever OU="*" OU1="*" | top OU

OU_Name Count Percent OU1_Name Count Percent

View solution in original post

0 Karma

somesoni2
Revered Legend

You would need to configure multi-value field extraction (not done by default) to capture all values of OU, using either of these methods

Fields.conf
https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields

Props/Transforms.conf
https://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextrac...

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I would recommend having a multi-valued field for OU since you can manipulate the field easier and won't have to explicitly call each field.

So for example if you wanted the top values of OU from 10-11am yesterday, then your search would look like this

index=whatever OU="*" | top OU

Which would produce an output like this

OU_Name Count Percent

But if you had a single valued field then your search and output would look like this

index=whatever OU="*" OU1="*" | top OU

OU_Name Count Percent OU1_Name Count Percent

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...