Splunk Search

ldapsearch after query: How do I run the ldapsearch on all users from the results obtained after the first search?

RubenElias
Loves-to-Learn Everything

Hii all...

Hope you can help me with two questions

1)Trying to create a query to find if the target user that set to "password never expirer" is a service user with using ldapsearch

main serch =                 index=microsoft-windows-dc EventID=4738 NewUacValue=0x210

I am trying  to run this ldapsearch on the results to remove  users with UserTypeName = service

| ldapsearch domain=default search="(sAMAccountName=user)" attrs="sAMAccountName,displayName,sn,UserTypeName"

How do I run the ldapsearch on all users from the results obtained after the first search ?

 

2. ldapsearch run only by admin , how to set Permissions to other roles to run ldapsearch 

Thanks ... 

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

What field does the index search return that can be used to match sAMAcountName in ldapsearch?  Assuming microsoft-windows-dc index has a field userName for this purpose, and assuming that the search doesn't return too many events, you can run map to run ldapsearch for each output directly.

index=microsoft-windows-dc EventID=4738 NewUacValue=0x210
| map search="ldapsearch domain=default search=\"(sAMAccountName=$userName$)\" attrs=\"sAMAccountName,displayName,sn,UserTypeName\""

By default map limits to maxsearches to 10; you may need to set this higher if the main search returns more than 10 events.  If you are only interested in certain statistics, and stats reduces number of rows significantly, run stats first.

Your second question is really an application question.  You need to read the documentation of ldapsearch.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...