Splunk Search

How to use ldap search to get computers from multiple groups?

chadman
Path Finder

I would like to use an LDAP search to find computers located in multiple groups. I tried something like this, but I cant get the syntax correct or even know if it's possible. I'm trying to find all computers in the patch1 and patch2 groups.

| ldapsearch domain=mydomain.com search=(&(objectClass=computer)(memberOf="CN=Patch1, OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND (memberOf="CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com) ) attrs=name
0 Karma
1 Solution

wenthold
Communicator

Do you want accounts that are in both patch1 and patch 2? Try this:

(&(objectClass=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com))

When you query ldap, the sections enclosed in parentheses will set by the initial operator, this case "AND" (&), so what you're asking for is:

( (objectClass=computer) AND (memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) )

If, for example, you wanted to find computers that were either in one group or the other, instead of both, the query would be:

 (&(objectClass=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))

View solution in original post

0 Karma

ferdydek
Path Finder

I think you want "objects that are computers AND (are in group1 OR are in group2)"

 (&(objectClass=computer)(|(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com") (memberOf="CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com")))

Hope this helps

0 Karma

wenthold
Communicator

Do you want accounts that are in both patch1 and patch 2? Try this:

(&(objectClass=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com))

When you query ldap, the sections enclosed in parentheses will set by the initial operator, this case "AND" (&), so what you're asking for is:

( (objectClass=computer) AND (memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) )

If, for example, you wanted to find computers that were either in one group or the other, instead of both, the query would be:

 (&(objectClass=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))
0 Karma

chadman
Path Finder

I am not able to get your first example to work without an error. I can do this below with quotes:

(&(objectClass=computer)(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com"))

I tried to do:

(&(objectClass=computer)(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com")(memberOf="CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com"))

that is not working either.

0 Karma

wenthold
Communicator

Try it without quotes ... and if there's still a problem, try

(&(objectClass=computer)(memberOf=*))

As a starting point, and you can also add a name filter with a wildcard ...

(&(objectClass=computer)(memberOf=*)(name=WKS-*))

When you're stuck it's not a bad idea to find to a point where your query works, then start narrow it down.

0 Karma

chadman
Path Finder

I have tried every combination I can think of. This works fine:

)

If I try to add something like (&(objectClass=computer)(memberOf=)(name=*wintel)) to the search it will show similar data, but only with servers that contain the name wintel.

0 Karma

wenthold
Communicator

Try this:

| ldapsearch search="(&(objectCategory=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))" | stats values(memberOf) as memberOf, count(memberOf) as group_count by name

This should list computers that are members of either group - from that you can see if you have the bisection of computers that exist in both groups. If you search for just members of one group do you get any results?

| ldapsearch search="(&(objectCategory=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com))
0 Karma

chadman
Path Finder

That did it! thanks so much.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...