The join command is very inefficient and not always necessary. Try this query using a subsearch. index=collect_identities sourcetype=ldap:query [ search index=db_mimecast splunkAccountCode=* mcType=auditLog
|fields user
| dedup user
| eval email=user, extensionAttribute10=user, extensionAttribute11=user
| fields email extensionAttribute10 extensionAttribute11
| format "(" "(" "OR" ")" "OR" ")"
]
| dedup email
| eval identity=replace(identity, "Adm0", "")
| eval identity=replace(identity, "Adm", "")
| eval identity=lower(identity)
| table email extensionAttribute10 extensionAttribute11 first last identity
| stats
values(email) AS email
values(extensionAttribute10) AS extensionAttribute10
values(extensionAttribute11) AS extensionAttribute11
values(first) AS first
values(last) AS last
BY identity
... View more
