I have a suspicion that Account_Name and uidNumber are equally populated, and that your intention is to get one row per uidNumber, not a multivalued uidNumber. If this is correct, just put Account_Name and uidNumber in groupby. index="wineventlog" EventCode=5136 LDAP_Display_Name=uidNumber
| rename Value as uidNumber
| fields user, uidNumber, Account_Name
| map search="| ldapsearch domain=*** search="(uidNumber=$uidNumber$)" attrs="*""
| stats values(dn) as dn, values(cn) as cn by Account_Name uidNumber If Account_Name may be null with a valid uidNumber, you can use values to preserve null values, like index="wineventlog" EventCode=5136 LDAP_Display_Name=uidNumber
| rename Value as uidNumber
| fields user, uidNumber, Account_Name
| map search="| ldapsearch domain=*** search="(uidNumber=$uidNumber$)" attrs="*""
| stats values(Account_Name) as Account_Name values(dn) as dn, values(cn) as cn by uidNumber
... View more