Getting Data In
Highlighted

Run external Linux command from within search.

Engager

I need to run a shell script or Linux command inside my search to obtain external Ldap information. I have a UserID that I would like to associate to a full name using a Ldapsearch command passing the UserID from the search.

Tags (2)
Highlighted

Re: Run external Linux command from within search.

Super Champion

Sounds like you want to use an external lookup script. These have to be written in python, but you can use a simply python script to call the necessary ldap commands (via command line, or via python ldap modules). From there it's a simple matter of writing out a CSV file that contains your new output fields.

Helpful resources:

Highlighted

Re: Run external Linux command from within search.

Splunk Employee
Splunk Employee

You can either use a lookup script (follow Lowell's links) or create a custom search command. I would recommend the lookup script, and it sounds like it fits your use case best. An similar alternative that can perform better if you don't require live lookups is to periodically export the data en masse from the LDAP server, write it into a CSV file format into the appropriate location on the Splunk search server, and use a Splunk file lookup against this file.

Highlighted

Re: Run external Linux command from within search.

Champion

It can be done:

  • Write a script that queries LDAP for all the required attributes and convert the resultset to a csv file.

  • Configure a lookup for your source or sourcetype to query the csv file to match the userid to CN.

View solution in original post