ldapsearch lookup: write to lookup csv after search not working because filename was used in saved search

[tkropp]

We discovered an odd problem (or maybe feature?):

Given this in SA-ldapsearch

[domain-lookup]
|ldapsearch domain=domain-identity search="(&(objectclass=user)(!(objectClass=computer)))" |eval suffix="" |eval priority="low" |eval category="dbag" |eval watchlist="false" |eval endDate="" |table sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate | rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate |outputlookup domain-identity.csv

1) The outputlookup does not write to domain-identity.csv located in /opt/splunk/etc/apps/SA-ldapsearch/lookups/

2) This only happened AFTER we created a saved search from the results to schedule a job 1x a week.

3) The name when changed to test.csv works fine, or any other name than what was specified in the schedule search.

Why it is an issue?

We want to schedule a search that writes the lookup file every week, to automate our identity lookups

[tkropp]

Here is the script we run

```

!/bin/bash

// remove the existing identities files
rm -rf identities.csv
rm -rf administrative_identities.csv

// merge the new identity files removing the headers from each
awk 'FNR > 1' id*.csv | grep -v admin > identities.csv
awk 'FNR > 1' *_admin*csv > administrative_identities.csv

//add the headers back into the new consolidated files
sed -i 1i"identity,prefix,nick,first,last,suffix,email,phone,phone2,managedBy,priority,bunit,category,watchlist,startDate,endDate" administrative_identities.csv
sed -i 1i"identity,prefix,nick,first,last,suffix,email,phone,phone2,managedBy,priority,bunit,category,watchlist,startDate,endDate" identities.csv

//copy over the new files to the Identity Manager context
cp -r identities.csv /opt/splunk/etc/apps/SA-IdentityManagement/lookups/.
cp -r administrative_identities.csv /opt/splunk/etc/apps/SA-IdentityManagement/lookups/.
```

[tkropp]

We have also had the same exact issue. The saved search features for Splunk to run SA-LDAPSEARCH 1x a week does not work (at all), and if you try, it makes the name of the file you use - UNUSABLE.

We have to manually enter the searches in the ldapsearch app, then combine the results for each OU (which we are returning results).

The end file is to have only a single

identities.csv

and

admin-identities.csv

which is expected by the IDentity Manager app.