I am having a bit of an issue with the collect command.
I'm trying to index an ldap search so i can use the data.
My ldap search is quite simple and it works well (i.e. it returns the expected results):
|ldapsearch search="(&(objectClass=computer)(!(useraccountcontrol:1.2.840.113518.104.22.1683:=2))" attrs="cn"
(I am getting the cn of every computer that is not disabled)
to this search, i am adding this so i can index the result in splunk:
|collect index=ldap_summary sourcetype=ldap:computeraccount
The indexing job works for the most part, but for a couple of hundreds of computer, it creates a single multi line event containing more than 200 events.
I cannot understand why it is doing this as i have tried the testmode attribute of the collect command, and the preview is correct: one single line events for every AD object.
Any help on the matter would be greatly appreciated.
... View more