Splunk Enterprise

Modification of the "_raw" field

nembela
Path Finder

Hi,

I havethe following search

index="windows" source=WinEventLog:Security  ([| inputlookup windows_group_change_events | where group_action like "member added" or group_action like "member removed" |  fields EventCode ]) NOT src_user=portalsync
|  ldapfilter search="(&(objectClass=group)(cn=$Group_Name$))" attrs="distinguishedname,description, info"
| eval _raw = json_object("time", _time, "action_by", src_user, "event_code", EventCode, "group", mvindex(Security_ID, 2), "member", mvindex(Security_ID, 1),"orig_sourcetype", sourcetype, "orig_host", host, "dn", distinguishedName, "desc", description, "info", info ) 
| fields _time, _raw
| collect index=windows_ad_summary addtime=0 source="windows_group_management"

 

I try to save the group membership change events to a different index for long-term retention.

I got the original idea from here: https://conf.splunk.com/files/2017/slides/using-splunk-enterprise-to-optimize-tailored-longterm-data...

My problem is that this search always returns "no results".

If I omit the "fields" and "collect" commands it returns results as intended. Also if I omit the "ldapfilter" command it works just fine.

Do you have any idea what is the problem with the combination of "ldapfilter" and "fields"?

 

Thanks,

Laszlo

 

Edit: I'm using Splunk 8.0.9

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...