Getting Data In

How to delete entire lookup table data?

pdafale_avantor
Engager

Hello all,

I have created a ldap search query to load identity data. I want all existing lookup table entries to be deleted and populate the same table with new entries obtained by scheduled search (weekly basis).

Let's say lookup name is identities.csv. Can someone help me with the query to delete all existing lookup table entries (identities.csv). 

 

Labels (3)
0 Karma
1 Solution

schose
Builder

Hi Prathamesh,

yes, this should work.. 

regards,

Andreas

View solution in original post

0 Karma

schose
Builder

Hi @pdafale_avantor ,

i hope i understood your question correctly: you want to recreate identities.csv every week from ldap.  You already have your ldap query, so it would be as simple as using the outputlookup command. This will create the lookup in the current app and overwrite the existing identities.csv

| ldapsearch domain=SPL search="(objectClass=user)" | stats something | outputlookup createinapp=t indentities.csv

best regards,

Andreas

0 Karma

pdafale_avantor
Engager

Hi @schose 

Thanks for the inputs. Yes exactly, I want to recreate identities.csv every week from ldap search query. I already have ldap search query which is correctly populating identities.csv as below. Please confirm if it shall work (recreate new data and remove all old entries) :-

 

|ldapsearch domain=DOMAIN_NAME
search="(&(objectclass=user)(!(objectClass=computer)))"
attrs="sAMAccountName,personalTitle,displayName,givenName,sn,mail,telephoneNumber,mobile,manager,department,whenCreated,userAccountControl"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate=""
|table
sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate | outputlookup createinapp=t indentities.csv

 

I am planning to run it as a scheduled search.

 

Regards,

Prathamesh

0 Karma

schose
Builder

Hi Prathamesh,

yes, this should work.. 

regards,

Andreas

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...