Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Performing an Splunk LDAP search from a field in an existing csv file

$
0
0
Here is what I'm trying to accomplish. I have an csv file that I generated with an existing search that looks like this IP,cn,Region,City,Country "0.0.0.0",johndoe,somestate,"somecity","United States" I'm trying to perform the ldap search using all of the cn field and append the results into a new table with additional ad values from the ldapsearch My single ldap search is presently working properly | ldapsearch domain=pa.lcl search="(cn=johndoe)" | table cn,title,displayName,employeeID,mail,company,department,extensionAttribute3,streetAddress,l,st,telephoneNumber,lastLogonTimestamp,lockoutTime,extensionAttribute15, | rename cn as "User ID", displayName as "Display Name", employeeID as "Employee Number", company as "Agency", department as "Department", mail as "Email" title as "Title", st as "State", streetAddress as "Street Address", l as "City", telephoneNumber as "Telephone Number", lastLogonTimestamp as "Last Logon", extensionAttribute15 as "VPN Group" extensionAttribute3 as "Deputate" lockoutTime as "LockOut Time" Here is the output of that search data removed User ID Title Display Name Employee Number Email Agency Department Deputate Street Address City State Telephone Number Last Logon LockOut Time VPN Group Here are the fields from the ldap search that I want to add to the final table cn,title,displayName,employeeID,mail,company,department,extensionAttribute3,streetAddress,l,st,telephoneNumber,lastLogonTimestamp,lockoutTime,extensionAttribute15, | rename cn as "User ID", displayName as "Display Name", employeeID as "Employee Number", company as "Agency", department as "Department", mail as "Email" title as "Title", st as "State", streetAddress as "Street Address", l as "City", telephoneNumber as "Telephone Number", lastLogonTimestamp as "Last Logon", extensionAttribute15 as "VPN Group" extensionAttribute3 as "Deputate" lockoutTime as "LockOut Time" Can anyone help? Thanks in advance. Robert

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>