I have finally found a workaround and the following is the workaround I used.
Just before the collect pipe, i stored the field that i wanted (here cn) in a table. The indexing result is composed of only single events (no more 300 hundred events in one) with info about the search and the table processing. At least i have my field and all the values i am interested in.
| ldapsearch search="(&(objectCategory=computer)(objectClass=user)(!(useraccountcontrol:1.2.840.113522.214.171.1243:=2)))" attrs="cn" | table cn | collect index=ldap_summary sourcetype="ldap:computeraccount"
I am not sure why this works but it does.
I hope this can help someone in the future.
... View more
I am having a bit of an issue with the collect command.
I'm trying to index an ldap search so i can use the data.
My ldap search is quite simple and it works well (i.e. it returns the expected results):
|ldapsearch search="(&(objectClass=computer)(!(useraccountcontrol:1.2.840.1135126.96.36.1993:=2))" attrs="cn"
(I am getting the cn of every computer that is not disabled)
to this search, i am adding this so i can index the result in splunk:
|collect index=ldap_summary sourcetype=ldap:computeraccount
The indexing job works for the most part, but for a couple of hundreds of computer, it creates a single multi line event containing more than 200 events.
I cannot understand why it is doing this as i have tried the testmode attribute of the collect command, and the preview is correct: one single line events for every AD object.
Any help on the matter would be greatly appreciated.
... View more