Splunk Search

How to populate results from regex into an ldap search?

fdevera
Path Finder

How would I take the results from this search:

| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"

And populate it into this LDAP search:

| ldapsearch domain=DEFAULT search="(&(objectClass=user)(exguid=GUID))"
| table name
Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Depending on how many results the first search returns, this may work

...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name
---
If this reply helps you, Karma would be appreciated.

View solution in original post

fdevera
Path Finder

Thanks @richgalloway . This works and displays the name properly but when used with other items that need to be tabled, it's the only field that returns results. Full search:

index=azuread sourcetype="ms:aad:audit" activityDisplayName="Update service principal" OR activityDisplayName="Add service principal credentials"
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.id, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, name
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I have no suggestions about that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Depending on how many results the first search returns, this may work

...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...