Field names with hyphens

[jpayne]

Some of the attribute names I would like to retrieve with the ldapfilter command include hyphens. As splunk field names cannot contain hyphens, the naive:

ldapfilter domain=FOO search="(&(objectClass=User)(sAMAccountname=$user$))" attrs="title,department,my-custom-attribute"

Doesn't work. How can I get this data out?

[martin_mueller · Accepted solution]

You would do a rename before the mvindex, for example. It's good practice to not have operators as part of field names, writing | eval foo = bar-baz would set foo to the difference between bar and baz, not to the value of a single field called bar-baz.

[ahardy42]

An example with rename my-custom-attr would be great

[martin_mueller]

Splunk field names in general can (but really shouldn't!) contain hyphens:

| stats count | eval my-custom-attr = "foo"

Must be something related to the ldapfilter command then. What happens if you leave off the attrs= parameter?

[jpayne]

I was misremembering the issue. The attributes from ldapfilter need a eval fooattr=mvindex(attribute,-1) in order to get them to display. That mvindex doesn't work with a hyphen in the field name.

Turns out that the custom attribute isn't one of them, so my efforts were unneeded. But out of curiosity, how would one address this? mvindex(my-custom-attribute,-1)