All Apps and Add-ons

Why do member fields not update where a user dn changes?

TomNL
Observer

using: Splunk Add-on for Microsoft Window 8.5.0

We have created report listing users that a part of specific groups using this logic

| inputlookup AD_Obj_User
| lookup AD_Obj_Group member AS dn

we noticed users disappearing from these reports when u user was moved to another ou.

This is what we see happening when we move a user to another group:

1: in the AD_Obj_User lookup the dn changes to cn=username, ou=NewGroup, ......

2: in the AD_Obj_Group lookup in the member files the user dn does not change, but still looks like cn=username, ou=NewGroup, ......

Because the dn of the user and the dn in the member field are now different the user disappears from the report.

As part of our debugging Efford we tried updating another property of the group (description) an after this also the member field in AD_Obj_Group is updated, and the user is back up the report again.

This looks like a bug to me, but maybe I'm missing something. Is anyone able to solve this mystery?

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...