Splunk Enterprise

ldapsearch - how to filter by whenCreated attribute

genesiusj
Builder

Hello,

I have this ldapsearch that returns  10's of thousands of records. 

 

 

| ldapsearch search=(&(objectClass=User)(!(objectClass=computer))) 

 

 

I want to filter on the whenCreated attribute to return new users in the past 7 days, sliding window. Is it possible to perform filtering by one or more attributes on the ldapsearch command line? I know I can use Splunk evals after  the ldapsearch command to do this.
Thanks and God bless,
Genesius

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

According to the docs at https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.3/User/Theldapsearchcommand, the argument to the search option can be any RFC 2554-compliant string, which should include whenCreated.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...