About mafruma

mafruma · ‎09-07-2023

Wow... This worked! Thank you very much. This has been a journey. Looks like I just need to shorten my relative time to avoid the max results and timeouts for the "map" function but that is totally worth it.

mafruma · ‎09-06-2023

Digging into the job inspector, it looks like the subsearch is not actually running before the ldapsearch runs.

mafruma · ‎09-06-2023

Your solution make sense but I am still getting this error when I try to run the search. External search command 'ldapsearch' returned error code 1. Script output = "error_message=invalid filter ".

mafruma · ‎09-05-2023

I need to run a daily ldap search that will grab only the accounts that have change in the last 2 days. I can hard code a data into the whenChanged attribute. | ldapsearch search="(&(objectClass=user)(whenChanged>=20230817202220.0Z)(!(objectClass=computer)))" |table cn whenChanged whenCreated I am trying to make whenChanged into a last 2 days variable that will work with ldap search. I can create a whenChanged using: |makeresults |eval whenChanged=strftime(relative_time(now(),"-2d@d"),"%Y%m%d%H%M%S.0Z")|fields - _time I could use the help getting that dynamic value into the ldap search so that I am looking for the >= values of whenChanged

mafruma · ‎06-10-2020

Yes! These are really big issues. I was looking for an obscure error this morning and cannot find the posts that Google finds because they are no longer available. I will likely need to open more support tickets for all of the questions that I used to be able to find answers to from the amazing community until this has been resolved.

mafruma · ‎01-13-2016

Hello all. I have not been able to populate a table via a search that uses inputlookup. My table is only populating with the data from the events. Where did I go wrong? My search: sourcetype=integration.wmb.event SAPTransactionID | append [ |inputlookup idocsDec.csv | fields + CREDAT,CRETIM,hour,minute,STATUS,TID | rename TID as SAPTransactionID] | transaction SAPTransactionID | table SAPTransactionID CREDAT CRETIM hour minute STATUS The only data that gets populated in the table is the SAPTransactionID. All of the other fields that I want to pull data from the csv are empty.

Posts	6
Solutions	0
Karma Given	17
Karma Received	1
Member Since	‎11-06-2014

Online Status	Offline
Date Last Visited	‎05-08-2024 06:58 PM

ldapsearch: Trying to search last 2 days in whenCh...

Where did I go wrong with my inputlookup search?

Re: ldapsearch: Trying to search last 2 days in wh...

Re: ldapsearch: Trying to search last 2 days in wh...

Re: ldapsearch: Trying to search last 2 days in wh...

ldapsearch: Trying to search last 2 days in whenCh...

Re: What happened to Answers? The change is for th...

Where did I go wrong with my inputlookup search?

Are you a member of the Splunk Community?