All Apps and Add-ons

MS Windows AD Objects App Custom Fields

JHannan
Explorer

Is there a method to add custom AD Attributes from the AD Objects to the AD Object KV Stores in the MS AD Objects App or are we better off using a separate search to set these objects in a "Supplemental" AD Objects KV Store?  Currently, the app maps most of the defaults AD Objects, but there are some that are not mapped that we'd like to add to the KV Store for use with other apps.

Labels (2)
0 Karma

jcooperFossil
Path Finder

Coming in years after this question was asked, because I've been trying to do the same and I finally figured it out today!

The TA is currently on version 4.1.1

To get additional fields to appear in AD_Obj_User you need to do the following:
Edit the macro `ms_obj_admon_base_out_user` and include the fields you want in the SPL for "fields" and "table"
Do the same for the macro `ms_obj_user_base_migrate` just in case.

The part I was missing for years up until now was you have to edit the KV Store to specify what fields are allowed to be stored.
Edit the Lookup (KV Store) AD_Obj_User (Collection name is AD_Obj_User_LDAP_list_kv) and add the desired fields.

Rebuild your lookup and you're good to go!

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...