All Apps and Add-ons

SA-LDAP field extraction

rajindurbal
Path Finder

How to make ldap search data searchable in Splunk Enterprise. I was able to run the following search within the add-on but when I collect the data the fields are no longer extracted.

| ldapsearch domain=default search="(objectClass=user)"
| collect index=summary

Could you tell me what I need to do to make this work or if it is even possible without creating a table of every field.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It should work, but have you tried this?

| ldapsearch domain=default search="(objectClass=user)"
| table *
| collect index=summary
---
If this reply helps you, an upvote would be appreciated.

rajindurbal
Path Finder

Thank you. This did work for me!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>