Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Re: How to get email id from LDAP
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to get email id from LDAP
in the following page, i can see list of users in splunk.
/manager/search/authentication/users
I see a field called Email address and we use LDAP authentication. I would like to configure splunk so that i can see user's email id auto populated from AD
my setting in authentication.conf
[authentication]
authSettings = AD,AD1
authType = LDAP
Anand
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We just upgraded to v6.2.1 and the Email Addresses are now being populated by LDAP.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A stop gap solution would be to pull from your AD or LDAP a .csv file containing username and email address. This can be uploaded as a lookup table and used in searches for internal and audit indexes. It doesn't put the emails where you want them but you'll have a way of accessing them for reporting or alerting.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is a bit of a showstopper - how are we supposed to populate email addresses ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This question has been around since at least May 2010 v4.1. http://splunk-base.splunk.com/answers/2138/ldap-authenticated-users-do-not-pick-up-mail-attribute-fr...
I'm on 5.0.3 and it looks like email addresses still can't be automatically pulled from AD and they can't even be added manually!
It should be pretty simple to add this feature.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have put in a feature request with splunk. They told me that they will add it. No SLA though
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
