I'm trying to create a report/dashboard that will show all users in the domain admins group, the query below does work and will create a report but the report is also missing users inside of the domain admins group. The users that are missing have their primary group set to domain admins.(This could be the issue) or a bug that inside of the Splunk Supporting Add-on for Active Directory. Any ideas?
| ldapsearch domain="domain" search="(&(objectclass=group)(cn=Domain Admins))"|fields *
| ldapgroup
| table member_name,member_type,member_dn
| sort member_name
| rename member_name as "Username",member_type as "Membership Type"
| search (Username !="" OR member_domain !="" OR Domain !="")
