All Apps and Add-ons

How do I use LDAP Search command, but still retain the event if match is not found?

eugenek
Path Finder

I want to use ldapfilter (or other LDAP search command) to try finding an object in AD, but if the object is not found, I want to still retain the event. Basically, the search below results not results because mydomain and the Sid are not found. I want it to sill return the Sid.

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn
0 Karma
1 Solution

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

View solution in original post

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

eugenek
Path Finder

Yes, that's what I was looking for. Just need more practice with append commands. I tried map and appendcols, which didn't help.

0 Karma

elliotproebstel
Champion

Yeah, it's not always easy to wrap your head around the options in Splunk. 🙂

Once you progress this to something more than a toy demo (like - you have a series of Sid values you are looking up, some of which are found by the ldapfilter command and some of which are not), you'll probably need to add a transforming command after the subsearch to filter duplicates and such.

0 Karma

eugenek
Path Finder

Yup. Did that with:

| sort Sid -cn
| dedup Sid

And it keeps only the ones which have a cn, if there are two entries for a Sid. I know dedup is not most efficient, but the number of results is small.

0 Karma

jlvix1
Communicator

I would try something like a combo of eval / if / isnull() to see if a field has data in, or exists then carry out actions after that ???

0 Karma

eugenek
Path Finder

Could you elaborate? There is data in the field, it just may not be found in LDAP.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...