topic Re: Filter a ldapsearch query for a specific group using a wildcard? in Splunk Search

Filter a ldapsearch query for a specific group using a wildcard?

krisdev — Tue, 22 Oct 2019 02:28:48 GMT

| ldapsearch domain=default search="(sAMAccountNAme=%user%)" attrs="memberOf", is the query I am using but I want to filter the results to only include users that are part of a Citrix group, is there a way?

Re: Filter a ldapsearch query for a specific group using a wildcard?

to4kawa — Wed, 23 Oct 2019 09:05:12 GMT

| stats count
| eval user=split("Allice,Bob,Smith,Ken,Cathey,Jeff,Tom,Bekkey",",")
| mvexpand user
| eval count=random() % 2
| eval memberOf=case(count==1,"Citrix",count==0,"notCitrix")
| fields user,memberOf
| where memberOf=="Citrix"

Hi, This is sample query.

| ldapsearch domain=default search="(sAMAccountNAme=%user%)" attrs="sAMAccountNAme,memberOf"
| where memberOf=="Citrix"

How about this? please change Citrix to an appropriate name.

Re: Filter a ldapsearch query for a specific group using a wildcard?

krisdev — Wed, 23 Oct 2019 09:43:45 GMT

Let me give this a go, will report back

Re: Filter a ldapsearch query for a specific group using a wildcard?

krisdev — Wed, 23 Oct 2019 11:07:05 GMT

This has seemed to scratch the itch I had with filtering by group, thanks @to4kawa .

Re: Filter a ldapsearch query for a specific group using a wildcard?

to4kawa — Wed, 23 Oct 2019 12:37:39 GMT

your welcome, happy Splunking

by the way

% user% → $ user $

it might be?

Re: Filter a ldapsearch query for a specific group using a wildcard?

krisdev — Wed, 23 Oct 2019 22:58:20 GMT

Thanks, yeah I always mix those two up all good!

Re: Filter a ldapsearch query for a specific group using a wildcard?

to4kawa — Thu, 24 Oct 2019 11:36:37 GMT

Yes, Happy Splunking.