Check where the ldapfilter domain has your correct configuration in the ldap config on your search head. |ldapfilter domain=(yourdefined connector) Here is the link to get you the info to put in after the = https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.1/User/ConfiguretheSplunkSupportingAdd-onforActiveDirectory ... View more

Not a dashboard but here is something that I am running. Basically if they are on vpn and have an entry I give them credit for an hour. Then I pass that along to AD to get some information like department based on Ad info. Nice way to see who really is on vpn or not index="paloalto" src_zone=globalprotect action=success | eval hour_min=strftime(_time, "%D %H:00") | table hour_min , user, dvc_name src_ip | eval user=mvindex(split(user,"\"),-1) | rename hour_min as Time dvc_name as "Palo Alto Device" src_ip as vpn_ip | dedup user, Time|ldapfilter domain=default search="(sAMAccountNAme=$user$)" attrs="displayName,StreetAddress,Department,name" | table Time, "Palo Alto Device", vpn_ip, displayName, department, streetAddress, user , name, ... View more