https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-search-results-as-a-token-to-an-ldapsearch-withtout/m-p/208532#M13088 <P>Trying to get a basic search of Windows event data to cross reference with fields from ldapsearch. I'm wanting it to take the value of a field (like Account_Name) in a Windows event and use it as a token to run an ldapsearch and return the value of a particular field from AD (like an OU). Rinse and repeat for all the values from the Windows results.</P> <P>I tried a join/append with the ldapsearch as the subsearch, and pondered creating a lookup table of the ldapsearch values. But we've got a very large environment (&gt;140,000 users) that makes the subsearch/lookup-table enormous. Since the Windows search normally only returns a couple dozen events, the processing time of the ldapsearch to return all possible values completely kills the value of the search. I really need to be able to limit the ldapsearch to just he couple dozen main-search values.</P> <P>How do I get &lt;main-search with $tokenvalues$&gt; to pass to | ldapsearch domain=mydomain search="$tokenvalues$" </P> Thu, 29 Oct 2015 17:13:52 GMT kearaspoor 2015-10-29T17:13:52Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-search-results-as-a-token-to-an-ldapsearch-withtout/m-p/208532#M13088 <P>Trying to get a basic search of Windows event data to cross reference with fields from ldapsearch. I'm wanting it to take the value of a field (like Account_Name) in a Windows event and use it as a token to run an ldapsearch and return the value of a particular field from AD (like an OU). Rinse and repeat for all the values from the Windows results.</P> <P>I tried a join/append with the ldapsearch as the subsearch, and pondered creating a lookup table of the ldapsearch values. But we've got a very large environment (&gt;140,000 users) that makes the subsearch/lookup-table enormous. Since the Windows search normally only returns a couple dozen events, the processing time of the ldapsearch to return all possible values completely kills the value of the search. I really need to be able to limit the ldapsearch to just he couple dozen main-search values.</P> <P>How do I get &lt;main-search with $tokenvalues$&gt; to pass to | ldapsearch domain=mydomain search="$tokenvalues$" </P> Thu, 29 Oct 2015 17:13:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-search-results-as-a-token-to-an-ldapsearch-withtout/m-p/208532#M13088 kearaspoor 2015-10-29T17:13:52Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-search-results-as-a-token-to-an-ldapsearch-withtout/m-p/208533#M13089 <P>You can use map:</P> <PRE><CODE>&lt;main-search with $tokenvalues$&gt; | map search="| ldapsearch domain=mydomain search=\"$tokenvalues$\" " </CODE></PRE> <P>Take a look at this too in case it helps:</P> <P><A href="https://answers.splunk.com/answers/349899/how-to-easily-replace-a-character-in-a-token-value.html#answer-349908">https://answers.splunk.com/answers/349899/how-to-easily-replace-a-character-in-a-token-value.html#answer-349908</A></P> <P>Thanks,<BR /> J</P> Thu, 28 Jan 2016 10:10:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-search-results-as-a-token-to-an-ldapsearch-withtout/m-p/208533#M13089 javiergn 2016-01-28T10:10:27Z