LDAP query for users

Splunk Search

Hello,

I want to search AD for all users in my organization. But as the list is huge, there is memory error occurring and I'm getting 0 results. Is there any way I can split my search. Below is the query I was trying.

| ldapsearch search="(&(objectclass=user)(CN=*))"
| table objectSid description sAMAccountName

What I want is like if there are 90000 users, I want to split my search for 1st 45000 users and last 45000 users.

Thanks in Advance

@woodcock

Get Updates on the Splunk Community!

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...