Splunk Enterprise Security

IF statement unable to pickup up from field

krish3
Contributor

Below is my query to separate priority accounts of AD based on group name but I am unable to assign any priority based on groups...

|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT" 
|eval priority=if(memberOf="Executive Account","high","medium")|stats count by priority

And also i would like to mention that below search gives me results without if condition

|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT" 
|search "Executive Accounts"

Also please let me know if any other alternative queries for importing the identities to ES App based on group wise priority.

Thanks,

0 Karma
1 Solution

krish3
Contributor

Hey Guys,

Thanks. I was able to make it work using like function of eval command.

But still not sure why it was not able work on using field=value condition

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

I do believe memberOf is a multivalue (or can be) field. So matching in the case of multiple group memberships will have some difficulty here.

0 Karma

krish3
Contributor

Hey Guys,

Thanks. I was able to make it work using like function of eval command.

But still not sure why it was not able work on using field=value condition

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!