Some of the attribute names I would like to retrieve with the ldapfilter command include hyphens. As splunk field names cannot contain hyphens, the naive:
ldapfilter domain=FOO search="(&(objectClass=User)(sAMAccountname=$user$))" attrs="title,department,my-custom-attribute"
Doesn't work. How can I get this data out?
You would do a rename
before the mvindex
, for example. It's good practice to not have operators as part of field names, writing | eval foo = bar-baz
would set foo
to the difference between bar
and baz
, not to the value of a single field called bar-baz
.
You would do a rename
before the mvindex
, for example. It's good practice to not have operators as part of field names, writing | eval foo = bar-baz
would set foo
to the difference between bar
and baz
, not to the value of a single field called bar-baz
.
An example with rename my-custom-attr would be great
Splunk field names in general can (but really shouldn't!) contain hyphens:
| stats count | eval my-custom-attr = "foo"
Must be something related to the ldapfilter
command then. What happens if you leave off the attrs=
parameter?
I was misremembering the issue. The attributes from ldapfilter need a eval fooattr=mvindex(attribute,-1) in order to get them to display. That mvindex doesn't work with a hyphen in the field name.
Turns out that the custom attribute isn't one of them, so my efforts were unneeded. But out of curiosity, how would one address this? mvindex(my-custom-attribute,-1)