It turns out that there is a different, but closely related technique for getting to the same result, if all you are interested in is the narrow goal of listing AD group direct membership. Instead of using LDAPGROUP, use the LDAPFETCH function. | ldapsearch search="(&(objectClass=Group)(cn=Remote Desktop Users)" | mvexpand member | ldapfetch dn=member attrs="cn" | table cn This returns the direct members of the group using their CN or any alternate attribute. It leaves me wondering what the best cases are for using the LDAPGROUP function.  The official documentation on it is fairly light and I was only able to find a small handful of examples online. ... View more

Thank you very much for the coaching on the multivalue functions.  I had never used any of those before. Your code suggestions for mvzip/mvexpand/mvindex worked exactly as described. This solution has the advantage of being able to generalize to many other scenarios.   ... View more

Thanks @richgalloway , As I understand it, LDAPGROUP is what is generating the MEMBER_TYPE information. https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.7/User/Theldapgroupcommand From your suggestions, I tried both  | ldapgroup | where member_type="DIRECT" | ldapgroup | search member_type="DIRECT" and both of them produce the same result as my original search - one nicely formatted row showing the group in one column and all of the group members in the other column - both DIRECT and NESTED. cn member_name member_type Remote Desktop Users       Finance Sales Fred Sam Joe Ted DIRECT DIRECT NESTED NESTED NESTED NESTED   My guess is that both SEARCH and WHERE are operating on the initial LDAPSEARCH operation. The group itself has matching member_type data.  The searches are all working, and nothing fails, so there doesn't appear to be anything illuminating in the debug log. I imagine I could REGEX the field to delete the unwanted entries from the view, but that seems like an odd workaround since LDAPGROUP is producing member_type data. I'm still just shy of having this work. ... View more