I'm trying to  use Splunk to return a list of records that have been modified in our LDAP since a particular datetime. There are certain attributes that I know exist in LDAP (e.g., weillCornellEduEndDate), and I can retrieve when using ldapsearch but that don't appear when I use ldapfilter (which I have to use; see previous sentence).   This works:   * | head 1 | eval x = "z" | table x | eval timestamp = "20200914213812Z" | ldapfilter domain=ED-people search="(&(objectClass=top)(|(modifyTimestamp>=$timestamp$)(createTimestamp>=$timestamp$)))" attrs="objectClass,cn,mail,title,o,sn,givenName" | table *                 This does NOT work:   * | head 1 | eval x = "z" | table x | eval timestamp = "20200914213812Z" | ldapfilter domain=ED-people search="(&(objectClass=top)(|(modifyTimestamp>=$timestamp$)(createTimestamp>=$timestamp$)))" attrs="objectClass,cn,mail,title,o,sn,givenName,weillCornellEduEndDate" | table *               Nor does this....   * | head 1 | eval x = "z" | table x | eval timestamp = "20200914213812Z" | ldapfilter domain=ED-people search="(&(objectClass=top)(|(modifyTimestamp>=$timestamp$)(createTimestamp>=$timestamp$)))" attrs="*" | table *               I'm using Splunk 7.2.9.1 and SA-LDAPSearch. Here's the error code in the logs. 09-15-2020 17:46:29.177 ERROR script - sid:1600206382.183889 External search command 'ldapfilter' returned error code 1. Script output = "error_message=Invalid attribute types in attrs list: weillCornellEduEndDate\r\n\r\n". ... View more

I am trying to join the results of two searches so it looks like this: CWID, authorization_pk,weillCornellEduPrimaryTitle paa2013, 1234, IT Support Manager paa2013, 5678, IT Support Manager paa2013, 9123, IT Support Manager ** The "AcctAdmin" search returns only 3 results... CWID, authorization_pk paa2013, 1234 paa2013, 5678 paa2013, 9123 The "LDAP" search returns 150,000 results... CWID, weillCornellEduPrimaryTitle paa2013, IT Support Manager brb2009, Professor ala9001, Help Desk Technician [150,000 more results!] ** Search #1, in which I start with the smaller result and join against the larger result. I presume this would be more efficient, but it doesn't work: | dbquery "AcctAdmin" "select CWID, authorization_pk from database.authorization a left join people_db.service s on s.service_pk = a.service_fk left join people_db.person p on p.PERSON_PK = a.PERSON_FK where CWID ='paa2013'" | rename CWID as weillCornellEduCWID | join weillCornellEduCWID [ | ldapsearch domain=ED-people search="objectClass=eduPerson" attrs="weillCornellEduCWID,weillCornellEduPrimaryTitle" | table weillCornellEduCWID, weillCornellEduPrimaryTitle ] | table * Search #2, in which I start with the larger result and join against the smaller result, does: | ldapsearch domain=ED-people search="objectClass=eduPerson" attrs="weillCornellEduCWID,weillCornellEduPrimaryTitle" | table weillCornellEduCWID, weillCornellEduPrimaryTitle | rename weillCornellEduCWID AS CWID | join CWID [ | dbquery "AcctAdmin" "select CWID, authorization_pk from people_db.database a left join people_db.service s on s.service_pk = a.service_fk left join people_db.person p on p.PERSON_PK = a.PERSON_FK where CWID ='paa2013'" ] | table * A lot of answers here suggest JOIN is inefficient but I don't see another way to do this. Oh, and "max=0" is no help. ... View more