Hi, i want to list members of a group and then list their groups in active directory, for that i have a lookup with all users, i request and format my list so it is nice for the ldap search : |inputlookup Domaine_LOL | search memberOf=*team_1* | table sAMAccountName | format "|" "(" "(" ")" " " ")" then i make my ldapsearch, the "static" version is as follow : | ldapsearch search="(&(objectClass=user)(|(cn=*user1*)(cn=*user2*)(cn=*user3*))(!(objectClass=computer)))" |ldapfetch dn=memberOf attrs="cn,description" |table sAMAccountName,cn,description |rename sAMAccountName as nom | sort + nom so the automated version should be | ldapsearch search="(&(objectClass=user)([ |inputlookup Domaine_LOL | search memberOf=*team_1* | table sAMAccountName | format "|" "(" "(" ")" " " ")"])(!(objectClass=computer)))" |ldapfetch dn=memberOf attrs="cn,description" |table sAMAccountName,cn,description |rename sAMAccountName as nom | sort + nom the problem is i get this error : Error in 'SearchParser': Missing a search command before '"'. Error at position '131' of search query '|ldapsearch search="(&(objectClass=user)(|[ |inpu...{snipped} {errorcontext = format "|" "(" "(" "}'. like splunk is waiting a search cmd in order to do an inputlook inside and ldapsearch .. any way around ? Thanks. ... View more

Hi, I need to index lists of machines or users that I get with and ldapsearch, I output them to CSV to make lookup, BUT there are some cases where I would want results to be indexed. How can I achieve this? ... View more

Hi, i was wondering if limitating fields with the "fields" command would have any impact on performance for stats command or timechart for exemple ? Thanks, ... View more

Hi, i'm trying to make a request to get the last logon for each users in my windows infrastructure; i have a simple request for now : host=* EventCode=4624 i can't find a time stamp for events, how do i get event time ? a second need would be to only keep in report the last "time" Thanks for comunity advises 😃 ... View more