All Apps and Add-ons

How do I use LDAP Search command, but still retain the event if match is not found?

eugenek
Path Finder

I want to use ldapfilter (or other LDAP search command) to try finding an object in AD, but if the object is not found, I want to still retain the event. Basically, the search below results not results because mydomain and the Sid are not found. I want it to sill return the Sid.

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn
0 Karma
1 Solution

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

View solution in original post

elliotproebstel
Champion

Perhaps wrapping the ldapfilter command in an appendpipe will give you what you're looking for:

| makeresults 
| eval Sid="S-1-5-21-111111111-111111111-1111111111-11111" 
| appendpipe 
 [| ldapfilter domain=mydomain search="(objectSid=$Sid$)" attrs=cn ]

eugenek
Path Finder

Yes, that's what I was looking for. Just need more practice with append commands. I tried map and appendcols, which didn't help.

0 Karma

elliotproebstel
Champion

Yeah, it's not always easy to wrap your head around the options in Splunk. 🙂

Once you progress this to something more than a toy demo (like - you have a series of Sid values you are looking up, some of which are found by the ldapfilter command and some of which are not), you'll probably need to add a transforming command after the subsearch to filter duplicates and such.

0 Karma

eugenek
Path Finder

Yup. Did that with:

| sort Sid -cn
| dedup Sid

And it keeps only the ones which have a cn, if there are two entries for a Sid. I know dedup is not most efficient, but the number of results is small.

0 Karma

jlvix1
Communicator

I would try something like a combo of eval / if / isnull() to see if a field has data in, or exists then carry out actions after that ???

0 Karma

eugenek
Path Finder

Could you elaborate? There is data in the field, it just may not be found in LDAP.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...