How to populate results from regex into an ldap search?

[fdevera]

How would I take the results from this search:

| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"

And populate it into this LDAP search:

| ldapsearch domain=DEFAULT search="(&(objectClass=user)(exguid=GUID))"
| table name

[fdevera]

Thanks @richgalloway . This works and displays the name properly but when used with other items that need to be tabled, it's the only field that returns results. Full search:

index=azuread sourcetype="ms:aad:audit" activityDisplayName="Update service principal" OR activityDisplayName="Add service principal credentials"
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.id, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, name

[richgalloway]

I have no suggestions about that.

[richgalloway · Accepted solution]

Depending on how many results the first search returns, this may work

...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name