topic Re: Populate Email Address for users in Reporting

Populate Email Address for users

shangshin — Thu, 15 Jan 2015 15:50:54 GMT

Hi,
I am using Splunk 6.1.2 and email mail addresses can't be automatically pulled from AD. Is there a way to manually insert user's email address?

Thanks in advance!

Re: Populate Email Address for users

Richfez — Thu, 15 Jan 2015 17:31:35 GMT

There are a couple of methods that could be used, depending on exactly what is meant by "email addresses can't be automatically pulled from AD".

I'd be interested to know if you have installed the splunk support for active directory app here to see what it can do for you? Once installed and configured as necessary, you should be able to do things like |ldapsearch domain=SPL search="(objectClass=user)" (which I pulled straight from their docs).

You could also create a lookup that reads from a file. Populate the CSV either manually or perhaps via powershell. (Search the web for "powershell export email addresses"). This could be scheduled (e.g. with Windows Task scheduler) once per day or something.

Re: Populate Email Address for users

shangshin — Thu, 15 Jan 2015 18:15:34 GMT

Hi,
I configured LDAP authentication, pointing to our AD domain controller. The users get mapped to roles successfully, but I examine the user's attributes under Manager>>Access controls>>Users>>juser, Email address is blank (and uneditable). The user is also unable to edit their own email preferences.

I didn't install the app -- Splunk Support for Active Directory. The main reason is because I don't have access to the LDAP window server in my firm.

I am wondering if it's possible to manually insert user's email address in some config file under $Splunk_Home/ directory.

Thank you!

Re: Populate Email Address for users

Richfez — Thu, 15 Jan 2015 18:27:42 GMT

Following along here:

Create the lookup file as CSV.
Create the local-to-your-server folder and put the file there.
Add a stanza to transforms.conf (local or in app, not "default" ).
Optionally, you can make the lookup "automatic" which will make the matched/lookup fields "just show up" in searches instead of requiring you to run a 'lookup' specifically.
Restart.

There is a great example at the bottom of the docs I linked to.

Re: Populate Email Address for users

Richfez — Thu, 15 Jan 2015 18:29:32 GMT

Note you'll want your csv to be at least two columns: the name to look up and the email you want returned. Like..

account, email
rich, richm@myemailaddress.com
bill, billg@microsoft.com
linus, linus@torvalds.net

Re: Populate Email Address for users

shangshin — Thu, 15 Jan 2015 18:33:26 GMT

My apology but I can't find the link of the great example at the bottom of the docs. Can you please post again?

Your help is greatly appreciated!

Re: Populate Email Address for users

shangshin — Thu, 15 Jan 2015 18:36:07 GMT

Is this the link you mention -- http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Addfieldsfromexternaldatasources

Re: Populate Email Address for users

shangshin — Thu, 15 Jan 2015 18:41:33 GMT

I read the online doc -- Configure CSV and external lookups
However, I still don't find how the csv file will map e.g. user ID rich with the email address.

Assuming the user, rich, runs an interactive search from GUI and sends the job to background. How will he receives an email to richm@myemailaddress.com when the job is completed?

Re: Populate Email Address for users

Richfez — Thu, 15 Jan 2015 18:45:23 GMT

OH!!!! Sorry, I think I totally misunderstood the problem!

That's a bit of a different beast and one I don't know the answer to.

Re: Populate Email Address for users

shangshin — Thu, 15 Jan 2015 18:46:43 GMT

No problem. Thanks for the prompt response in any case!

Re: Populate Email Address for users

somesoni2 — Thu, 15 Jan 2015 21:38:32 GMT

If the information is not flowing from AD directly, may be monitoring AD (See here) will help you get the information to Splunk. Once its in Splunk, you can join/correlate using search query OR can setup a auto-update lookup table with that information.

Re: Populate Email Address for users

shangshin — Thu, 15 Jan 2015 21:54:49 GMT

I can confirm user's email address is available in AD directory. However, when I examine the user's attributes under Manager>>Access controls>>Users>>juser, Email address is blank (and uneditable). The user is also unable to edit their own email preferences.

Basically, I am seeking a way to manually insert user's email address in some config file under $Splunk_Home/ directory.

Re: Populate Email Address for users

somesoni2 — Thu, 15 Jan 2015 22:32:14 GMT

Ok, I was going through the documentation for version 6.2.1 and found one related thing. In authentication.conf, there is an attribute called "emailAttribute"
emailAttribute =
* OPTIONAL
* This is the user entry attribute whose value is their email address.
* Defaults to 'mail'

IMO, this should be attribute set correctly to a value based on your AD setting (it may be possible that email addresses are stored in some other user attribute for your AD than 'mail').

I didn't see this property in previous versions and I have checked couple of my instances using Splunk 5 as well as Splunk 6.0/6.1.2 and all don't show email address from AD.

Would be interesting to see if there is any workaround available for previous version.

Re: Populate Email Address for users

shangshin — Fri, 16 Jan 2015 18:52:47 GMT

Thank you for pinpointing the information. I will need to first find out the key of the entry attribute -- emailAttribute in our firm's AD directory.