Hello Splunk friends,
I'm trying to use ldapsearch to ingest certain attributes into an index. Currently some attributes, such as employeeID are not being returned. I've tried the following searches:
| ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="employeeID"
or
| ldapsearch domain=MYDOMAIN.COM search="(objectclass=user)" basedn="DC=sub,DC=domain,DC=mydomain,DC=com" attrs="name,cn,givenName,displayName,sn,title,employeeID,departmentNumber,dNSHostName,description,objectClass,primaryGroupID,pwdLastSet,whenCreated,whenChanged,lastLogonTimestamp,logonCount,lockoutTime,badPasswordTime,accountExpires"
| table name, cn, givenName, displayName, sn, title, employeeID, departmentNumber, dNSHostName, description, objectClass, primaryGroupID, pwdLastSet, whenCreated, whenChanged, lastLogonTimestamp, logonCount, lockoutTime, badPasswordTime, accountExpires
I've also tried "domain=default" and excluding the domain.
When I run ldapsearch from my own computer or from a server, it returns these attributes just fine. I checked ldap.conf and I also checked the Splunk Supporting Add-on for Active Directory (SA-ldapsearch) config test connection and it all seems to work OK. I read up on the Global Catalog, but I'm not familiar Active Directory.
I've done a lot of searches on Google and this website but I can't seem to find any information that's getting me on the right path to a solution. Would any of you please give me some advice?
Thank you!
Z
