All Apps and Add-ons

How do I use LDAP Search command, but still retain the event if match is not found?

eugenek
Path Finder

I want to use ldapfilter (or other LDAP search command) to try finding an object in AD, but if the object is not found, I want to still retain the event. Basically, the search below results not results because mydomain and the Sid are not found. I want it to sill return the Sid.

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn
0 Karma
1 Solution

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

View solution in original post

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

eugenek
Path Finder

Yes, that's what I was looking for. Just need more practice with append commands. I tried map and appendcols, which didn't help.

0 Karma

elliotproebstel
Champion

Yeah, it's not always easy to wrap your head around the options in Splunk. 🙂

Once you progress this to something more than a toy demo (like - you have a series of Sid values you are looking up, some of which are found by the ldapfilter command and some of which are not), you'll probably need to add a transforming command after the subsearch to filter duplicates and such.

0 Karma

eugenek
Path Finder

Yup. Did that with:

| sort Sid -cn
| dedup Sid

And it keeps only the ones which have a cn, if there are two entries for a Sid. I know dedup is not most efficient, but the number of results is small.

0 Karma

jlvix1
Communicator

I would try something like a combo of eval / if / isnull() to see if a field has data in, or exists then carry out actions after that ???

0 Karma

eugenek
Path Finder

Could you elaborate? There is data in the field, it just may not be found in LDAP.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...