Getting Data In

How to delete entire lookup table data?

pdafale_avantor
Engager

Hello all,

I have created a ldap search query to load identity data. I want all existing lookup table entries to be deleted and populate the same table with new entries obtained by scheduled search (weekly basis).

Let's say lookup name is identities.csv. Can someone help me with the query to delete all existing lookup table entries (identities.csv). 

 

Labels (3)
0 Karma
1 Solution

schose
Builder

Hi Prathamesh,

yes, this should work.. 

regards,

Andreas

View solution in original post

0 Karma

schose
Builder

Hi @pdafale_avantor ,

i hope i understood your question correctly: you want to recreate identities.csv every week from ldap.  You already have your ldap query, so it would be as simple as using the outputlookup command. This will create the lookup in the current app and overwrite the existing identities.csv

| ldapsearch domain=SPL search="(objectClass=user)" | stats something | outputlookup createinapp=t indentities.csv

best regards,

Andreas

0 Karma

pdafale_avantor
Engager

Hi @schose 

Thanks for the inputs. Yes exactly, I want to recreate identities.csv every week from ldap search query. I already have ldap search query which is correctly populating identities.csv as below. Please confirm if it shall work (recreate new data and remove all old entries) :-

 

|ldapsearch domain=DOMAIN_NAME
search="(&(objectclass=user)(!(objectClass=computer)))"
attrs="sAMAccountName,personalTitle,displayName,givenName,sn,mail,telephoneNumber,mobile,manager,department,whenCreated,userAccountControl"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate=""
|table
sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate | outputlookup createinapp=t indentities.csv

 

I am planning to run it as a scheduled search.

 

Regards,

Prathamesh

0 Karma

schose
Builder

Hi Prathamesh,

yes, this should work.. 

regards,

Andreas

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...