Below is my query to separate priority accounts of AD based on group name but I am unable to assign any priority based on groups...
|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval priority=if(memberOf="Executive Account","high","medium")|stats count by priority
And also i would like to mention that below search gives me results without if condition
|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|search "Executive Accounts"
Also please let me know if any other alternative queries for importing the identities to ES App based on group wise priority.
Thanks,
Hey Guys,
Thanks. I was able to make it work using like
function of eval command.
But still not sure why it was not able work on using field=value
condition
I do believe memberOf is a multivalue (or can be) field. So matching in the case of multiple group memberships will have some difficulty here.
Hey Guys,
Thanks. I was able to make it work using like
function of eval command.
But still not sure why it was not able work on using field=value
condition