All Apps and Add-ons

SA-LDAP field extraction

Path Finder

How to make ldap search data searchable in Splunk Enterprise. I was able to run the following search within the add-on but when I collect the data the fields are no longer extracted.

| ldapsearch domain=default search="(objectClass=user)"
| collect index=summary

Could you tell me what I need to do to make this work or if it is even possible without creating a table of every field.

0 Karma

SplunkTrust
SplunkTrust

It should work, but have you tried this?

| ldapsearch domain=default search="(objectClass=user)"
| table *
| collect index=summary
---
If this reply helps you, an upvote would be appreciated.

Path Finder

Thank you. This did work for me!

0 Karma