All Apps and Add-ons

ldapfilter: unable use fields returned by ldapfilter in subsequent operations

abpe
Path Finder

I am doing the following search on Splunk 4.3.6 search head:

sourcetype="WinEventLog:Security" EventCode=5136 Class=groupPolicyContainer | eval DN=replace(DN,"}","},") | ldapfilter domain=$Account_Domain$ search="(distinguishedName=$DN$)" attrs=displayName

The idea is to get the display name of the modified GPO. The search produces the expected results. However, when I try to pipe the result to a table like this:

| table Account_Name,displayName 

the displayName column is empty.
What am I doing wrong?
Thanks.

Tags (1)
0 Karma
1 Solution

abpe
Path Finder

Well I figured out the problem. In my case it is returning the displayName as a multivalue field, the first value being empty and the second value containing what I expect. I added the following to my search:

...|eval displayName=mvindex(displayName,-1)|...

I don't know though why ldapfilter returns a multivalue field.

View solution in original post

0 Karma

abpe
Path Finder

Well I figured out the problem. In my case it is returning the displayName as a multivalue field, the first value being empty and the second value containing what I expect. I added the following to my search:

...|eval displayName=mvindex(displayName,-1)|...

I don't know though why ldapfilter returns a multivalue field.

0 Karma

howyagoin
Contributor

This does seem to work, but isn't really a great solution; when I create a table based on the mvindex'd field name, I am seeing loads of results with empty values, and attempting to remove them with a "| search NOT displayName=""" doesn't work...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...