How to delete entire lookup table data?

[pdafale_avantor]

Hello all,

I have created a ldap search query to load identity data. I want all existing lookup table entries to be deleted and populate the same table with new entries obtained by scheduled search (weekly basis).

Let's say lookup name is identities.csv. Can someone help me with the query to delete all existing lookup table entries (identities.csv). 

[schose]

Hi @pdafale_avantor ,

i hope i understood your question correctly: you want to recreate identities.csv every week from ldap.  You already have your ldap query, so it would be as simple as using the outputlookup command. This will create the lookup in the current app and overwrite the existing identities.csv

| ldapsearch domain=SPL search="(objectClass=user)" | stats something | outputlookup createinapp=t indentities.csv

best regards,

Andreas

[pdafale_avantor]

Hi @schose 

Thanks for the inputs. Yes exactly, I want to recreate identities.csv every week from ldap search query. I already have ldap search query which is correctly populating identities.csv as below. Please confirm if it shall work (recreate new data and remove all old entries) :-

|ldapsearch domain=DOMAIN_NAME
search="(&(objectclass=user)(!(objectClass=computer)))"
attrs="sAMAccountName,personalTitle,displayName,givenName,sn,mail,telephoneNumber,mobile,manager,department,whenCreated,userAccountControl"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate=""
|table
sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate | outputlookup createinapp=t indentities.csv

I am planning to run it as a scheduled search.

Regards,

Prathamesh

[schose · Accepted solution]

Hi Prathamesh,

yes, this should work.. 

regards,

Andreas