Splunk Search

How to populate results from regex into an ldap search?

fdevera
Path Finder

How would I take the results from this search:

| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"

And populate it into this LDAP search:

| ldapsearch domain=DEFAULT search="(&(objectClass=user)(exguid=GUID))"
| table name
Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Depending on how many results the first search returns, this may work

...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

fdevera
Path Finder

Thanks @richgalloway . This works and displays the name properly but when used with other items that need to be tabled, it's the only field that returns results. Full search:

index=azuread sourcetype="ms:aad:audit" activityDisplayName="Update service principal" OR activityDisplayName="Add service principal credentials"
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.id, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, name
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I have no suggestions about that.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Depending on how many results the first search returns, this may work

...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name
---
If this reply helps you, an upvote would be appreciated.

View solution in original post