Splunk Search

How to populate results from regex into an ldap search?

fdevera
Path Finder

How would I take the results from this search:

| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"

And populate it into this LDAP search:

| ldapsearch domain=DEFAULT search="(&(objectClass=user)(exguid=GUID))"
| table name
Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Depending on how many results the first search returns, this may work

...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name
---
If this reply helps you, Karma would be appreciated.

View solution in original post

fdevera
Path Finder

Thanks @richgalloway . This works and displays the name properly but when used with other items that need to be tabled, it's the only field that returns results. Full search:

index=azuread sourcetype="ms:aad:audit" activityDisplayName="Update service principal" OR activityDisplayName="Add service principal credentials"
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.id, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, name
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I have no suggestions about that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Depending on how many results the first search returns, this may work

...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...