All Apps and Add-ons

BUG: ldapfilter does not properly output whenCreated field.

peter_krammer
Communicator

App: SA-ldapsearch (Version 2.2.0)
There is a difference between the output of ldapsearch and ldapfilter when it comes to the whenCreated attribute.
In ldapfilter the output is not a date, but code that looks like it is supposed to format the date.
You can see it by running this query:

|ldapsearch domain=default search="(sAMAccountName=Administrator)" attrs="sAMAccountName,whenCreated"
|eval ldapsearch_whenCreated=whenCreated
|ldapfilter domain=default search="(sAMAccountName=$sAMAccountName$)" attrs="whenCreated"
|eval ldapfilter_whenCreated=whenCreated
|table sAMAccountName, ldapsearch_whenCreated, ldapfilter_whenCreated

alt text

0 Karma

marycordova
SplunkTrust
SplunkTrust

can you post screenshots of the output for both

@marycordova
0 Karma

BigCosta
Path Finder

The same problem with the whenChanged attribute

0 Karma

peter_krammer
Communicator

Yes of course.

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...