https://community.splunk.com/t5/Security/LDAP-Query-Pull-the-Description-and-Office-fields-within-AD/m-p/474166#M10983 <P>Hi,</P> <P>I need to pull the description and office fields in active directory in my SPL query. What would be the best syntax to use. What I am doing is simply a basic string search for "TOR" and would like the results to list also the user's description and office field values within AD.</P> <P>Current Search:</P> <PRE><CODE>index=* sourcetype=* "TOR" |stats count by user |ldapfilter search="(&amp;(objectclass=user)(!(objectClass=computer))(samAccountName=$samAccountName$))" attrs="description, physicalDeliveryOfficeName" |sort -count </CODE></PRE> Thu, 02 Jan 2020 15:34:33 GMT itsmevic 2020-01-02T15:34:33Z https://community.splunk.com/t5/Security/LDAP-Query-Pull-the-Description-and-Office-fields-within-AD/m-p/474166#M10983 <P>Hi,</P> <P>I need to pull the description and office fields in active directory in my SPL query. What would be the best syntax to use. What I am doing is simply a basic string search for "TOR" and would like the results to list also the user's description and office field values within AD.</P> <P>Current Search:</P> <PRE><CODE>index=* sourcetype=* "TOR" |stats count by user |ldapfilter search="(&amp;(objectclass=user)(!(objectClass=computer))(samAccountName=$samAccountName$))" attrs="description, physicalDeliveryOfficeName" |sort -count </CODE></PRE> Thu, 02 Jan 2020 15:34:33 GMT https://community.splunk.com/t5/Security/LDAP-Query-Pull-the-Description-and-Office-fields-within-AD/m-p/474166#M10983 itsmevic 2020-01-02T15:34:33Z https://community.splunk.com/t5/Security/LDAP-Query-Pull-the-Description-and-Office-fields-within-AD/m-p/474167#M10984 <P>I don't have experience with this command, but the examples in the documentation show outputting to the "table" command. You might want to try adding:</P> <PRE><CODE>| table user,description,physicalDeliveryOfficeName,count </CODE></PRE> <P>ahead of the sort</P> Thu, 02 Jan 2020 16:01:12 GMT https://community.splunk.com/t5/Security/LDAP-Query-Pull-the-Description-and-Office-fields-within-AD/m-p/474167#M10984 mydog8it 2020-01-02T16:01:12Z