Thanks for advise, but I found the problem.
Probably in version 8 the command map need the syntax "map cn" and quote breaks, in this case it looks like:
| inputlookup lookupfile.csv | table cn | map cn search="| ldapsearch domain=pa.lcl search=\"(cn=$cn$)\" | table cn,title,displayName,employeeID,mail,company,department,extensionAttribute3,streetAddress,l,st,telephoneNumber,lastLogonTimestamp,lockoutTime,extensionAttribute15" | rename cn as "User ID", displayName as "Display Name", employeeID as "Employee Number", company as "Agency", department as "Department", mail as "Email" title as "Title", st as "State", streetAddress as "Street Address", l as "City", telephoneNumber as "Telephone Number", lastLogonTimestamp as "Last Logon", extensionAttribute15 as "VPN Group" extensionAttribute3 as "Deputate" lockoutTime as "LockOut Time"
thanks
https://answers.splunk.com/answers/813606/combine-base-search-with-ldapsearch.html
... View more