Splunk Search

How to extract fields from /services/authentication/current-context?

Cbr1sg
Path Finder

Hello all,
The command
| rest /services/authentication/current-context
will return some fields like username, email, realname, etc..
I want to get other fields on LDAP like Telephone Number, SIP address, etc..
Is it possible?
Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll need a secondary data source, e.g. ldapsearch, to retrieve that information, use the username returned by current-context as a filter.

https://splunkbase.splunk.com/app/1151/

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll need a secondary data source, e.g. ldapsearch, to retrieve that information, use the username returned by current-context as a filter.

https://splunkbase.splunk.com/app/1151/

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

SA-ldapsearch runs on linux splunk servers.

If you don't have AD, consider https://splunkbase.splunk.com/app/3872/

0 Karma

Cbr1sg
Path Finder

after tried again, i finally made this works. Thanks a lot!

0 Karma

Cbr1sg
Path Finder

i already looked into this, unfortunately my server is linux so this solution is not compatible, do you have other suggestion for linux? Thanks

0 Karma

Sukisen1981
Champion

Well, you can always define regular expressions to fetch needed field value, are you looking to extract ALL fields automatically? There is limitations on that

0 Karma

Cbr1sg
Path Finder

I want to get these 2 fields SipAddress and Phone, could you please advise what regex to use and where can I apply it?

Thanks

0 Karma

Sukisen1981
Champion

can you post a sample of your events as they appear in splunk?

0 Karma

Cbr1sg
Path Finder

I think you might have misunderstood my question, and sorry as I wasn't clear enough.

I want to get additional information which does NOT exist in current-context,
When the user authenticates using LDAP username/password, Splunk does the ldap lookup and returns some of standard fields like username, email, realname, etc..
Besides those fields, i want to get something else which is missing, for example Phone and SipAddress

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...