Splunk Search

How to use ldap search to get computers from multiple groups?

chadman
Path Finder

I would like to use an LDAP search to find computers located in multiple groups. I tried something like this, but I cant get the syntax correct or even know if it's possible. I'm trying to find all computers in the patch1 and patch2 groups.

| ldapsearch domain=mydomain.com search=(&(objectClass=computer)(memberOf="CN=Patch1, OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND (memberOf="CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com) ) attrs=name
0 Karma
1 Solution

wenthold
Communicator

Do you want accounts that are in both patch1 and patch 2? Try this:

(&(objectClass=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com))

When you query ldap, the sections enclosed in parentheses will set by the initial operator, this case "AND" (&), so what you're asking for is:

( (objectClass=computer) AND (memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) )

If, for example, you wanted to find computers that were either in one group or the other, instead of both, the query would be:

 (&(objectClass=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))

View solution in original post

0 Karma

ferdydek
Path Finder

I think you want "objects that are computers AND (are in group1 OR are in group2)"

 (&(objectClass=computer)(|(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com") (memberOf="CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com")))

Hope this helps

0 Karma

wenthold
Communicator

Do you want accounts that are in both patch1 and patch 2? Try this:

(&(objectClass=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com))

When you query ldap, the sections enclosed in parentheses will set by the initial operator, this case "AND" (&), so what you're asking for is:

( (objectClass=computer) AND (memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) )

If, for example, you wanted to find computers that were either in one group or the other, instead of both, the query would be:

 (&(objectClass=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))
0 Karma

chadman
Path Finder

I am not able to get your first example to work without an error. I can do this below with quotes:

(&(objectClass=computer)(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com"))

I tried to do:

(&(objectClass=computer)(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com")(memberOf="CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com"))

that is not working either.

0 Karma

wenthold
Communicator

Try it without quotes ... and if there's still a problem, try

(&(objectClass=computer)(memberOf=*))

As a starting point, and you can also add a name filter with a wildcard ...

(&(objectClass=computer)(memberOf=*)(name=WKS-*))

When you're stuck it's not a bad idea to find to a point where your query works, then start narrow it down.

0 Karma

chadman
Path Finder

I have tried every combination I can think of. This works fine:

)

If I try to add something like (&(objectClass=computer)(memberOf=)(name=*wintel)) to the search it will show similar data, but only with servers that contain the name wintel.

0 Karma

wenthold
Communicator

Try this:

| ldapsearch search="(&(objectCategory=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))" | stats values(memberOf) as memberOf, count(memberOf) as group_count by name

This should list computers that are members of either group - from that you can see if you have the bisection of computers that exist in both groups. If you search for just members of one group do you get any results?

| ldapsearch search="(&(objectCategory=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com))
0 Karma

chadman
Path Finder

That did it! thanks so much.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...