All Apps and Add-ons

Is there any way around Splunk waiting for a cmd in order to do an inputlookup in an ldapsearch?

Ed_Alias
Path Finder

Hi, i want to list members of a group and then list their groups in active directory,

for that i have a lookup with all users, i request and format my list so it is nice for the ldap search :

|inputlookup Domaine_LOL | search memberOf=*team_1* | table sAMAccountName | format "|" "(" "(" ")" " " ")"

then i make my ldapsearch, the "static" version is as follow :

| ldapsearch search="(&(objectClass=user)(|(cn=*user1*)(cn=*user2*)(cn=*user3*))(!(objectClass=computer)))" 

    |ldapfetch dn=memberOf attrs="cn,description"
    |table sAMAccountName,cn,description
    |rename sAMAccountName as nom
      | sort + nom

so the automated version should be

| ldapsearch search="(&(objectClass=user)([ |inputlookup Domaine_LOL | search memberOf=*team_1* | table sAMAccountName | format "|" "(" "(" ")" " " ")"])(!(objectClass=computer)))" 

    |ldapfetch dn=memberOf attrs="cn,description"
    |table sAMAccountName,cn,description
    |rename sAMAccountName as nom
      | sort + nom

the problem is i get this error :

Error in 'SearchParser': Missing a search command before '"'. Error at position '131' of search query '|ldapsearch search="(&(objectClass=user)(|[ |inpu...{snipped} {errorcontext = format "|" "(" "(" "}'.

like splunk is waiting a search cmd in order to do an inputlook inside and ldapsearch ..

any way around ?

Thanks.

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You need to escape the double-quotes with backslash ( \) like this:

| ldapsearch search="(&(objectClass=user)([ |inputlookup Domaine_LOL | search memberOf=*team_1* | table sAMAccountName | format \"|\" \"(\" \"(\" \")\" \" \" \")\"])(!(objectClass=computer)))"

View solution in original post

0 Karma

woodcock
Esteemed Legend

You need to escape the double-quotes with backslash ( \) like this:

| ldapsearch search="(&(objectClass=user)([ |inputlookup Domaine_LOL | search memberOf=*team_1* | table sAMAccountName | format \"|\" \"(\" \"(\" \")\" \" \" \")\"])(!(objectClass=computer)))"
0 Karma

johannes_ru
New Member

This solution does not work (  "error_message=invalid filter") because it produces the column value is enclosed with double quotes and therefore the result of the subquery ends up like this (with my example):

| ldapsearch search="(&(objectClass=group)([| rest splunk_server=local /services/admin/SAML-groups | rename title as cn | table cn | uniq| format \"\|\" \"(\" \"(\" \")\" \"\" \"\"]))"
| ldapsearch search="(&(objectClass=group)(| ( cn="app-splunk-a-d" ) ( cn="app-splunk-b-d" ))"

 

This cannot work as long as one can configure the column enclosings.

0 Karma

Ed_Alias
Path Finder

Hi, you were right the escape did things better, so request is now interprated but i still get a "bad filter" Error.

i finally found i was wrong on the way i do my request, i found a much easyer way to achieve what i need with ldapfetch !

i ldapsearch the users members of the group i need and then lists their group memberships, ldapfetch then go get cn and description of groups, muuuch better 🙂

| ldapsearch domain="default" search="(&(objectClass=user)(cn=*))" attrs="sAMAccountName,mail,memberOf"
| search memberOf="CN=Team_1,OU=Groupes,OU=...,OU=....,OU=Users,DC=domain,DC=com" 
|mvexpand memberOf |ldapfetch dn=memberOf attrs="cn,description"
| table sAMAccountName mail cn description
| rename sAMAccountName  AS user
| rename cn AS group_name

thanks for your help 🙂

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept on the answer to close the question.

0 Karma

gcusello
SplunkTrust
SplunkTrust

there is a pipe before the square parentheses .
Bye.
Giuseppe

0 Karma

Ed_Alias
Path Finder

hi,

thanks i did a bad copy in my post, but it doesnt solve the problem.

(i do reinject this needed pipe with the format cmd inside the subsearch)

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...