Knowledge Management

Collect Command Creating Single Line Events and One Multi line Event

mgagnaire
Engager

Hello,

I am having a bit of an issue with the collect command.
I'm trying to index an ldap search so i can use the data.
My ldap search is quite simple and it works well (i.e. it returns the expected results):

|ldapsearch search="(&(objectClass=computer)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2))" attrs="cn"

(I am getting the cn of every computer that is not disabled)

to this search, i am adding this so i can index the result in splunk:

|collect index=ldap_summary sourcetype=ldap:computeraccount

The indexing job works for the most part, but for a couple of hundreds of computer, it creates a single multi line event containing more than 200 events.

I cannot understand why it is doing this as i have tried the testmode attribute of the collect command, and the preview is correct: one single line events for every AD object.

Any help on the matter would be greatly appreciated.

Thank you.

Omar

0 Karma
1 Solution

mgagnaire
Engager

Hello,

I have finally found a workaround and the following is the workaround I used.

Just before the collect pipe, i stored the field that i wanted (here cn) in a table. The indexing result is composed of only single events (no more 300 hundred events in one) with info about the search and the table processing. At least i have my field and all the values i am interested in.

| ldapsearch search="(&(objectCategory=computer)(objectClass=user)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" attrs="cn" | table cn | collect index=ldap_summary sourcetype="ldap:computeraccount"

I am not sure why this works but it does.
I hope this can help someone in the future.

Regards,

Omar

View solution in original post

mgagnaire
Engager

Hello,

I have finally found a workaround and the following is the workaround I used.

Just before the collect pipe, i stored the field that i wanted (here cn) in a table. The indexing result is composed of only single events (no more 300 hundred events in one) with info about the search and the table processing. At least i have my field and all the values i am interested in.

| ldapsearch search="(&(objectCategory=computer)(objectClass=user)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" attrs="cn" | table cn | collect index=ldap_summary sourcetype="ldap:computeraccount"

I am not sure why this works but it does.
I hope this can help someone in the future.

Regards,

Omar

View solution in original post

proylea
Contributor

Thanks Omar, that did help, I had individual events with the same time stamp getting processed by collect in multivalue events.
Your answer helped me find the workaround, I put
table _raw
before the collect and it has maintained single events.

Cheers

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!