Splunk Enterprise Security


Loves-to-Learn Lots

How would I find sAMAccountName(s) - more than one. I have tried boolean operators and(&) or(|) to no avail. Currently only one works. 
| ldapsearch domain=xxxx basedn="DC=xxxx,DC=xxxx" search="(&(objectClass=user)(sAMAccountName=specificuser))"

Labels (1)
0 Karma

Ultra Champion

You want to find more than one user? Just add another sAMAccountName condition 🙂

The trick is that ldap filters use prefix notation, not infix one so you need to do it like this:

(&(objectClass=user)(|(sAMAccountName=specificuser)(sAMAccountName=otheruser)(sAMAccountName=thirduser)(and so on)))

I hope I got my parentheses right. 😄

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...