Knowledge Management

Collect Command Creating Single Line Events and One Multi line Event

mgagnaire
Engager

Hello,

I am having a bit of an issue with the collect command.
I'm trying to index an ldap search so i can use the data.
My ldap search is quite simple and it works well (i.e. it returns the expected results):

|ldapsearch search="(&(objectClass=computer)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2))" attrs="cn"

(I am getting the cn of every computer that is not disabled)

to this search, i am adding this so i can index the result in splunk:

|collect index=ldap_summary sourcetype=ldap:computeraccount

The indexing job works for the most part, but for a couple of hundreds of computer, it creates a single multi line event containing more than 200 events.

I cannot understand why it is doing this as i have tried the testmode attribute of the collect command, and the preview is correct: one single line events for every AD object.

Any help on the matter would be greatly appreciated.

Thank you.

Omar

0 Karma
1 Solution

mgagnaire
Engager

Hello,

I have finally found a workaround and the following is the workaround I used.

Just before the collect pipe, i stored the field that i wanted (here cn) in a table. The indexing result is composed of only single events (no more 300 hundred events in one) with info about the search and the table processing. At least i have my field and all the values i am interested in.

| ldapsearch search="(&(objectCategory=computer)(objectClass=user)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" attrs="cn" | table cn | collect index=ldap_summary sourcetype="ldap:computeraccount"

I am not sure why this works but it does.
I hope this can help someone in the future.

Regards,

Omar

View solution in original post

mgagnaire
Engager

Hello,

I have finally found a workaround and the following is the workaround I used.

Just before the collect pipe, i stored the field that i wanted (here cn) in a table. The indexing result is composed of only single events (no more 300 hundred events in one) with info about the search and the table processing. At least i have my field and all the values i am interested in.

| ldapsearch search="(&(objectCategory=computer)(objectClass=user)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" attrs="cn" | table cn | collect index=ldap_summary sourcetype="ldap:computeraccount"

I am not sure why this works but it does.
I hope this can help someone in the future.

Regards,

Omar

proylea
Contributor

Thanks Omar, that did help, I had individual events with the same time stamp getting processed by collect in multivalue events.
Your answer helped me find the workaround, I put
table _raw
before the collect and it has maintained single events.

Cheers

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...