All Apps and Add-ons

Field names with hyphens

jpayne
Explorer

Some of the attribute names I would like to retrieve with the ldapfilter command include hyphens. As splunk field names cannot contain hyphens, the naive:

ldapfilter domain=FOO search="(&(objectClass=User)(sAMAccountname=$user$))" attrs="title,department,my-custom-attribute"

Doesn't work. How can I get this data out?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You would do a rename before the mvindex, for example. It's good practice to not have operators as part of field names, writing | eval foo = bar-baz would set foo to the difference between bar and baz, not to the value of a single field called bar-baz.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You would do a rename before the mvindex, for example. It's good practice to not have operators as part of field names, writing | eval foo = bar-baz would set foo to the difference between bar and baz, not to the value of a single field called bar-baz.

ahardy42
Engager

An example with rename my-custom-attr would be great

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Splunk field names in general can (but really shouldn't!) contain hyphens:

| stats count | eval my-custom-attr = "foo"

Must be something related to the ldapfilter command then. What happens if you leave off the attrs= parameter?

jpayne
Explorer

I was misremembering the issue. The attributes from ldapfilter need a eval fooattr=mvindex(attribute,-1) in order to get them to display. That mvindex doesn't work with a hyphen in the field name.

Turns out that the custom attribute isn't one of them, so my efforts were unneeded. But out of curiosity, how would one address this? mvindex(my-custom-attribute,-1)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...