I'm having trouble using Tableau to extract data for a Tableau report. I can connect to the saved-search fine by connecting live, but when I try to generate an extract (for Tableau report performance reasons) it gives the error
"internal error starextracttuplesource has wrong number of bindings for number of input columns".
When I look at the fields available in the Tableau DataSource page, it shows the 3 explicit fields I defined in my report search, but also an additional field not present in the search ([MySplunkSavedReport].[_pre_msg]). This is odd for me, as I am able to generate an extract from another saved report, which also includes similar fields ( logonuser (text), usertype (text), and _time).
Is this related to the known issue identified as DVPL-2957? Any recommendations as to how I can resolve? A somwhat cleaned-up search is below if it is helpful or needed to give context (I can provide more details/clarification if needed).
Thanks in advance to any splunk gurus who can help!
Jeff
host=server* source="WinEventLog:Microsoft-Windows-TerminalServices-SessionBroker/Operational" 801 | rex field=Message "user DOMAINName\\\(?<logonUser>.\w+)" |eval ADAccount=ltrim(logonUser,"DOMAINName\\") | ldapfilter domain=DOMAINName search="(sAMAccountName=$ADAccount$)" attrs="memberOf" | eval userType=case((mvfind(memberOf,"CN\=GRP_Name1") >= 0 ), "Group1", (mvfind(memberOf,"CN\=GRP_Name2") >= 0 ), "Group2", (mvfind(memberOf,"CN\=GRP_Name3") >= 0 ), "Group3") | fields logonUser,userType,_time
... View more