Splunk Search

How to extract fields from /services/authentication/current-context?

Cbr1sg
Path Finder

Hello all,
The command
| rest /services/authentication/current-context
will return some fields like username, email, realname, etc..
I want to get other fields on LDAP like Telephone Number, SIP address, etc..
Is it possible?
Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll need a secondary data source, e.g. ldapsearch, to retrieve that information, use the username returned by current-context as a filter.

https://splunkbase.splunk.com/app/1151/

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll need a secondary data source, e.g. ldapsearch, to retrieve that information, use the username returned by current-context as a filter.

https://splunkbase.splunk.com/app/1151/

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

SA-ldapsearch runs on linux splunk servers.

If you don't have AD, consider https://splunkbase.splunk.com/app/3872/

0 Karma

Cbr1sg
Path Finder

after tried again, i finally made this works. Thanks a lot!

0 Karma

Cbr1sg
Path Finder

i already looked into this, unfortunately my server is linux so this solution is not compatible, do you have other suggestion for linux? Thanks

0 Karma

Sukisen1981
Champion

Well, you can always define regular expressions to fetch needed field value, are you looking to extract ALL fields automatically? There is limitations on that

0 Karma

Cbr1sg
Path Finder

I want to get these 2 fields SipAddress and Phone, could you please advise what regex to use and where can I apply it?

Thanks

0 Karma

Sukisen1981
Champion

can you post a sample of your events as they appear in splunk?

0 Karma

Cbr1sg
Path Finder

I think you might have misunderstood my question, and sorry as I wasn't clear enough.

I want to get additional information which does NOT exist in current-context,
When the user authenticates using LDAP username/password, Splunk does the ldap lookup and returns some of standard fields like username, email, realname, etc..
Besides those fields, i want to get something else which is missing, for example Phone and SipAddress

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...