That table should have been in the OP since it clarifies the problem. It appears that ldapgroup creates multivalue fields that standard where/search operators can't handle. The solution is to expand the multivalue fields before filtering them. To retain the relationship between member_name and member_type, we'll use mvzip to pair them up before expanding them. | ldapsearch search="(&(objectClass=Group)(cn=Remote Desktop Users)"
| table cn,distinguishedName
| ldapgroup
``` Combine member_name and member_type
| eval member_name_type=mvzip(member_name, member_type, "#")
``` Put each member into a separate event ```
| mvexpand member_name_type
``` Break the member field apart again ```
| eval member_name_type = split(member_name_type, "#")
| eval member_name=mvindex(member_name_type,0), member_type=mvindex(member_name_type,1)
| where member_type="DIRECT"
| table cn,member_name,member_type
... View more
