I am able to pull my AD users account information successfully except for their email addresses. What am I doing wrong? Apologize since I am still learning.
| inputlookup AD_Obj_User WHERE domain="mydomain"
| fields domain, sAMAccountName, userAccountControl, uac_details,domain, distinguishedName, mail, whenChanged,whenCreated
| table domain, sAMAccountName, userAccountControl, uac_details,domain, distinguishedName, mail, whenChanged,whenCreated
| eval uac_details=replace(mvjoin(uac_details,":"),"([\r\n]+)",":")
| makemv delim=":" uac_details
| search [| makeresults | eval uac_details=replace("#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#,#empty#","#empty#","")
| makemv delim="," uac_details
| eval mfilt_uac=mvfilter(match(uac_details,"^\w+"))
| eval search=if(isnull(mfilt_uac),"","uac_details=\"".mvjoin(mfilt_uac,"\" AND uac_details=\"")."\"")
| table search]
| sort 0 sAMAccountName
| rename sAMAccountName AS "user", uac_details AS userAccountControl_Details
... View more