All Apps and Add-ons

How do I use LDAP Search command, but still retain the event if match is not found?

eugenek
Path Finder

I want to use ldapfilter (or other LDAP search command) to try finding an object in AD, but if the object is not found, I want to still retain the event. Basically, the search below results not results because mydomain and the Sid are not found. I want it to sill return the Sid.

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn
0 Karma
1 Solution

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

View solution in original post

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

eugenek
Path Finder

Yes, that's what I was looking for. Just need more practice with append commands. I tried map and appendcols, which didn't help.

0 Karma

elliotproebstel
Champion

Yeah, it's not always easy to wrap your head around the options in Splunk. 🙂

Once you progress this to something more than a toy demo (like - you have a series of Sid values you are looking up, some of which are found by the ldapfilter command and some of which are not), you'll probably need to add a transforming command after the subsearch to filter duplicates and such.

0 Karma

eugenek
Path Finder

Yup. Did that with:

| sort Sid -cn
| dedup Sid

And it keeps only the ones which have a cn, if there are two entries for a Sid. I know dedup is not most efficient, but the number of results is small.

0 Karma

jlvix1
Communicator

I would try something like a combo of eval / if / isnull() to see if a field has data in, or exists then carry out actions after that ???

0 Karma

eugenek
Path Finder

Could you elaborate? There is data in the field, it just may not be found in LDAP.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...