topic Re: ldap seach with a wildcard in Splunk Search

ldap seach with a wildcard

chadman — Wed, 28 Mar 2018 12:45:25 GMT

I have a search below that works fine, but I would like to add a wildcard to it.

This search works
| ldapsearch domain=mydomain.com search=(&(objectClass=computer)(memberOf="CN=Patch1, OU=Patches,OU=Wintel,DC=Mydomain,DC=com)) attrs=name

I would like to do something like below, but it does not show any results with the wildcard.
| ldapsearch domain=mydomain.com search=(&(objectClass=computer)(memberOf="CN=Patch*, OU=Patches,OU=Wintel,DC=Mydomain,DC=com)) attrs=name

Re: ldap seach with a wildcard

hos_2 — Wed, 28 Mar 2018 14:32:45 GMT

Hey Chadman,

Try something like this:
search="(CN=Patch*)"

and keep adding to if that is working in your environment.

Or you can get a bit more creative (not sure if this will work for you, you may want to try creating a Lookup that you can pull the data from, to search):

| ldapsearch domain=mydomain.com search=objectClass=computer | search memberOf="(CN=Patch*, OU=Patches,OU=Wintel,DC=Mydomain,DC=com)"

Re: ldap seach with a wildcard

chadman — Wed, 28 Mar 2018 14:39:37 GMT

hos_2,
That does kind of work, but how can I do something like below to narrow down the search?
search="(CN=Patch*)(OU=Wintel)"

Re: ldap seach with a wildcard

hos_2 — Wed, 28 Mar 2018 14:43:08 GMT

Maybe something like this?

search memberOf="CN=Patch*" AND memberOf=(OU=Patches,OU=Wintel,DC=Mydomain,DC=com)

Re: ldap seach with a wildcard

chadman — Wed, 28 Mar 2018 15:15:43 GMT

Cant get that to work, syntax might be wrong. I have tried a couple variations. I also tried to add basedn=(OU=Patches,OU=Wintel,DC=Mydomain,DC=com) thinking that would limit the scope of my search, but it's not.

Re: ldap seach with a wildcard

hos_2 — Wed, 28 Mar 2018 15:19:57 GMT

Yeah we had similar issues with the data, our work around was to just gather everything in a lookup daily, then run searches off the lookup tables.

Re: ldap seach with a wildcard

chadman — Wed, 28 Mar 2018 18:05:15 GMT

Thanks. I might look into that also. I was hopping to avoid having another process to create the lookup table. I also posted another question similar, but without wild cards.

Re: ldap seach with a wildcard

EdBruce — Thu, 07 Mar 2019 15:28:41 GMT

I believe you need to use the and filtercomp "&". Still learning myself, but might try:

search=(&(CN=Patch*)&(OU=Wintel))

Re: ldap seach with a wildcard

Eric_Mcknight — Fri, 09 Aug 2019 16:49:04 GMT

This issue has been resolved: https://docs.splunk.com/Documentation/SA-LdapSearch/2.2.1/User/ReleaseNotes#Fixed_issues