Filter a ldapsearch query for a specific group using a wildcard?

[krisdev]

| ldapsearch domain=default search="(sAMAccountNAme=%user%)" attrs="memberOf", is the query I am using but I want to filter the results to only include users that are part of a Citrix group, is there a way?

[to4kawa · Accepted solution]

| stats count
| eval user=split("Allice,Bob,Smith,Ken,Cathey,Jeff,Tom,Bekkey",",")
| mvexpand user
| eval count=random() % 2
| eval memberOf=case(count==1,"Citrix",count==0,"notCitrix")
| fields user,memberOf
| where memberOf=="Citrix"

Hi, This is sample query.

| ldapsearch domain=default search="(sAMAccountNAme=%user%)" attrs="sAMAccountNAme,memberOf"
| where memberOf=="Citrix"

How about this? please change Citrix to an appropriate name.

[krisdev]

Let me give this a go, will report back

[krisdev]

This has seemed to scratch the itch I had with filtering by group, thanks @to4kawa .

[to4kawa]

your welcome, happy Splunking

by the way

% user% → $ user $

it might be?

[krisdev]

Thanks, yeah I always mix those two up all good!

[to4kawa]

Yes, Happy Splunking.