Splunk Enterprise Security

ldapsearch

deepdiver
Loves-to-Learn Everything

How would I find sAMAccountName(s) - more than one. I have tried boolean operators and(&) or(|) to no avail. Currently only one works. 
| ldapsearch domain=xxxx basedn="DC=xxxx,DC=xxxx" search="(&(objectClass=user)(sAMAccountName=specificuser))"

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You want to find more than one user? Just add another sAMAccountName condition 🙂

The trick is that ldap filters use prefix notation, not infix one so you need to do it like this:

(&(objectClass=user)(|(sAMAccountName=specificuser)(sAMAccountName=otheruser)(sAMAccountName=thirduser)(and so on)))

I hope I got my parentheses right. 😄

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...