All Apps and Add-ons

Why is my ldapsearch command search not returning certain attributes such as "employeeID"?

Path Finder

Hello Splunk friends,

I'm trying to use ldapsearch to ingest certain attributes into an index. Currently some attributes, such as employeeID are not being returned. I've tried the following searches:

| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="employeeID"

or

| ldapsearch domain=MYDOMAIN.COM search="(objectclass=user)" basedn="DC=sub,DC=domain,DC=mydomain,DC=com" attrs="name,cn,givenName,displayName,sn,title,employeeID,departmentNumber,dNSHostName,description,objectClass,primaryGroupID,pwdLastSet,whenCreated,whenChanged,lastLogonTimestamp,logonCount,lockoutTime,badPasswordTime,accountExpires"
| table name, cn, givenName, displayName, sn, title, employeeID, departmentNumber, dNSHostName, description, objectClass, primaryGroupID, pwdLastSet, whenCreated, whenChanged, lastLogonTimestamp, logonCount, lockoutTime, badPasswordTime, accountExpires

I've also tried "domain=default" and excluding the domain.

When I run ldapsearch from my own computer or from a server, it returns these attributes just fine. I checked ldap.conf and I also checked the Splunk Supporting Add-on for Active Directory (SA-ldapsearch) config test connection and it all seems to work OK. I read up on the Global Catalog, but I'm not familiar Active Directory.

I've done a lot of searches on Google and this website but I can't seem to find any information that's getting me on the right path to a solution. Would any of you please give me some advice?

Thank you!
Z

0 Karma
1 Solution

Path Finder

I found out a possible solution. I changed the LDAP port to connect to the local domain: "389". I am now able to look up these attributes.

View solution in original post

Path Finder

I found out a possible solution. I changed the LDAP port to connect to the local domain: "389". I am now able to look up these attributes.

View solution in original post