topic Re: combine csv lookup table (list of users) to ldapsearch in Splunk Search

combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 22 Jan 2018 13:57:39 GMT

Trying to search with ldapsearch a list of specific users.

| ldapsearch domain="default" search="(&(samAccountType=805306368))"

with inputlookup user_lookupnew.csv which is my list of specific user.

any help would be great.

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 22 Jan 2018 14:13:31 GMT

| ldapsearch domain="default" search="(&(samAccountType=805306368))" | inputlookup user_lookup.csv

not working

Re: combine csv lookup table (list of users) to ldapsearch

maciep — Sat, 27 Jan 2018 15:06:01 GMT

i think you want lookup, not inputlookup

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 09:38:45 GMT

| ldapsearch domain="default" search="(&(samAccountType=805306368))" | lookup user_lookup.csv

Still get errors.

I will look at the documentation around the lookup command. Thanks.

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 09:48:50 GMT

if you could share sample output and what field name are present in output:

| ldapsearch domain="default" search="(&(samAccountType=805306368))"

and

|inputlookup user_lookupnew.csv

what output you are receiving by running above two query separately?

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 10:31:11 GMT

No errors if run individually

Re: combine csv lookup table (list of users) to ldapsearch

maciep — Mon, 29 Jan 2018 10:51:21 GMT

what errors exactly?

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 11:08:13 GMT

by what field name you are trying to join your base search with lookup?

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 12:07:36 GMT

The A1 field is called "member"

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 12:10:06 GMT

does this member field is present in your base search as well as lookup?

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 12:12:30 GMT

it is present in the top bar then starting at 1 is the first user.

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 12:16:22 GMT

if same field name is present in lookup as well then try this:

| ldapsearch domain="default" search="(&(samAccountType=805306368))" 
| lookup user_lookupnew.csv member as member OUPUT <your required lookup field name>

here add your lookup field name which has list of specific user

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 12:23:14 GMT

Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 12:25:31 GMT

could you specify your lookup fields...also what query did you try?

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 12:57:00 GMT

A1 = member
A2 = user ID

A3 = user ID

and so on, looking to search all the users in the list.

| ldapsearch domain="default" search="(&(samAccountType=805306368))"
| lookup user_lookupnew.csv member as member OUPUT

= a field in the csv or the a field for the ldapsearch?

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 13:02:39 GMT

only one column is present in your lookup?

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 13:05:18 GMT

yep only one

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 13:24:19 GMT

also can you share output of base query as i just want to know which field is common in both
also if in lookup only one field is their i.e.memberwhich is in common then what is use of join?

Re: combine csv lookup table (list of users) to ldapsearch

493669 — Mon, 29 Jan 2018 13:24:37 GMT

also can you share output of base query as i just want to know which field is common in both
also if in lookup only one field is their i.e.memberwhich is in common then what is use of join?

Re: combine csv lookup table (list of users) to ldapsearch

SGun — Mon, 29 Jan 2018 13:52:24 GMT

| ldapsearch domain="default" search="(&(samAccountType=805306368))"
| lookup user_lookupnew.csv member as member OUTPUT member

This search shows all user rather than just the ones in the CSV