topic Re: ldapsearch Error under user audit "Splunk for Windows Server Active Directory App" in Getting Data In

ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

Eric — Mon, 09 Jul 2012 23:15:01 GMT

Need to some help getting my install of "Splunk for Windows Server Active Directory" app working. when I run the "User login Failures" search and click on a user that has a failed logon attempt I get these errors...

"Lookup table 'HostInfo' is empty"
"No Matching fields exist"
"Error in 'script': Getinfo probe failed for external search command 'ldapsearch'"

The last error is in Red.

Ideas?

Regards,
Eric

Re: ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

Eric — Tue, 10 Jul 2012 02:15:42 GMT

Okay so I have moved a little further with this issue.. I did not have Perl configured all the way, but now I get error 255 when Perl tries to run.

Re: ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

Eric — Tue, 10 Jul 2012 20:07:09 GMT

Moved my splunk install to *nix and still cant get this thing to work. 😞

Re: ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

itfpmhtcom — Thu, 19 Jul 2012 21:25:09 GMT

Running into the same problem here; though I'm still at the initial error - I'll try configuring Perl, but would expect to run into the second issue as well. My install is running on Debian Squeeze.

Re: ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

splunkn — Fri, 10 Aug 2012 13:12:56 GMT

I'm having a similar isuse but the error only occurs when I try to run any of the Security > Audit > Reports.

I receive the error in red across the top:

Error in 'script': Getinfo probe failed for external search command 'ldapsearch'

Any suggestions are apprecaited.

Re: ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

splunkn — Fri, 10 Aug 2012 13:23:17 GMT

Current known issues
The LDAP search commands (that install on the central Splunk App for
Active Directory instance) do not work on Windows operating systems,
owing to platform compatibility issues. As a workaround, build your central
Splunk instance around the Linux platform (MSAD-73).
·
The LDAP search commands do not work for sub-domains in an AD forest
(MSAD-105).
·
Older versions of the universal forwarder might not correctly get some
Windows events. To fix this issue, upgrade your forwarders to the latest
version. (SPL-51312)
·
52

Re: ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

splunkn — Fri, 10 Aug 2012 13:24:24 GMT

I'm running this on Windows, so I think I answered my own question. Hopefully this can help someone else who is having the same issues.