Splunk Search

ldapsearch through map command is blanking out the rest of my table except for it's own output

fdevera
Path Finder

1st search works (I get all fields in my table including GUID):

 

earliest=-1y index=azuread sourcetype="ms:aad:audit" category=DirectoryManagement (activityDisplayName="CreateTrustFrameworkPolicy" OR activityDisplayName="Add unverified domain" OR activityDisplayName="Add verified domain" OR activityDisplayName="Set federation settings on domain" OR activityDisplayName="Get tenant details" OR activityDisplayName="Initialize tenant" OR activityDisplayName="Create company" OR activityDisplayName="Create program")
| fillnull value=”N/A”
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, GUID

 

2nd search works (I get cn from map command by itself):

 

earliest=-1y index=azuread sourcetype="ms:aad:audit" category=DirectoryManagement (activityDisplayName="CreateTrustFrameworkPolicy" OR activityDisplayName="Add unverified domain" OR activityDisplayName="Add verified domain" OR activityDisplayName="Set federation settings on domain" OR activityDisplayName="Get tenant details" OR activityDisplayName="Initialize tenant" OR activityDisplayName="Create company" OR activityDisplayName="Create program")
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| fillnull value=”N/A”
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(qcguid=$GUID$))\" attrs=cn"
| table cn

 

3rd search combining the two searches blanks out my table but properly shows cn field obtained from map:

 

earliest=-1y index=azuread sourcetype="ms:aad:audit" category=DirectoryManagement (activityDisplayName="CreateTrustFrameworkPolicy" OR activityDisplayName="Add unverified domain" OR activityDisplayName="Add verified domain" OR activityDisplayName="Set federation settings on domain" OR activityDisplayName="Get tenant details" OR activityDisplayName="Initialize tenant" OR activityDisplayName="Create company" OR activityDisplayName="Create program")
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| fillnull value=”N/A”
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(qcguid=$GUID$))\" attrs=cn"
| table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, GUID,cn

 

How do fix this? Append, appendcols, join? Any idea?

Thanks!

Labels (6)
Tags (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!