Hello, I am having a bit of an issue with the collect command. I'm trying to index an ldap search so i can use the data. My ldap search is quite simple and it works well (i.e. it returns the expected results): |ldapsearch search="(&(objectClass=computer)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2))" attrs="cn" (I am getting the cn of every computer that is not disabled) to this search, i am adding this so i can index the result in splunk: |collect index=ldap_summary sourcetype=ldap:computeraccount The indexing job works for the most part, but for a couple of hundreds of computer, it creates a single multi line event containing more than 200 events. I cannot understand why it is doing this as i have tried the testmode attribute of the collect command, and the preview is correct: one single line events for every AD object. Any help on the matter would be greatly appreciated. Thank you. Omar ... View more