Splunk Search

How to extract fields from /services/authentication/current-context?

Cbr1sg
Path Finder

Hello all,
The command
| rest /services/authentication/current-context
will return some fields like username, email, realname, etc..
I want to get other fields on LDAP like Telephone Number, SIP address, etc..
Is it possible?
Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll need a secondary data source, e.g. ldapsearch, to retrieve that information, use the username returned by current-context as a filter.

https://splunkbase.splunk.com/app/1151/

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll need a secondary data source, e.g. ldapsearch, to retrieve that information, use the username returned by current-context as a filter.

https://splunkbase.splunk.com/app/1151/

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

SA-ldapsearch runs on linux splunk servers.

If you don't have AD, consider https://splunkbase.splunk.com/app/3872/

0 Karma

Cbr1sg
Path Finder

after tried again, i finally made this works. Thanks a lot!

0 Karma

Cbr1sg
Path Finder

i already looked into this, unfortunately my server is linux so this solution is not compatible, do you have other suggestion for linux? Thanks

0 Karma

Sukisen1981
Champion

Well, you can always define regular expressions to fetch needed field value, are you looking to extract ALL fields automatically? There is limitations on that

0 Karma

Cbr1sg
Path Finder

I want to get these 2 fields SipAddress and Phone, could you please advise what regex to use and where can I apply it?

Thanks

0 Karma

Sukisen1981
Champion

can you post a sample of your events as they appear in splunk?

0 Karma

Cbr1sg
Path Finder

I think you might have misunderstood my question, and sorry as I wasn't clear enough.

I want to get additional information which does NOT exist in current-context,
When the user authenticates using LDAP username/password, Splunk does the ldap lookup and returns some of standard fields like username, email, realname, etc..
Besides those fields, i want to get something else which is missing, for example Phone and SipAddress

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...