https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191853#M38221 <P>I'm getting the same message</P> Thu, 02 Feb 2017 08:18:53 GMT stefan1988 2017-02-02T08:18:53Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191849#M38217 <P>I am constantly getting the following message from splunk forwarder splunkd.log </P> <P>03-17-2014 11:38:28.245 -0700 WARN ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - SysmonMigrator::read - 'sysmon.conf' was not found, no migration is required.<BR /> 03-17-2014 11:58:32.247 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 11:58:32.247 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 11:58:32.247 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 11:58:32.247 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:01:17.610 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:01:17.610 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:12:15.646 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:12:15.646 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:15:01.594 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:15:01.594 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:15:01.594 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:15:01.594 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:16:33.793 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:16:33.793 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:18:02.373 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:18:02.373 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:18:02.373 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:18:02.373 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:20:46.566 -0700 INFO WatchedFile - Logfile truncated while open, original pathname file='C:\Users\rq113d\Desktop\test1\IVTRUpdateLog_2014-03-16 20-101.txt', will begin reading from start.<BR /> 03-17-2014 12:24:25.501 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:24:25.501 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:24:25.501 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error<BR /> 03-17-2014 12:24:25.501 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 03-17-2014 12:39:50.170 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::GetInt64Val: ldap_get_values error</P> <P>Is anyone having similar issue? what this error indicates. Any suggestions? </P> Mon, 28 Sep 2020 16:09:47 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191849#M38217 CSabhaya 2020-09-28T16:09:47Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191850#M38218 <P>We are facing a similar issue as well. We are trying to read windows event logs from a machine which has a Splunk forwarder installed version 5.0.1. The inputs.conf file is as below:</P> <P>[WinEventLog://Application]<BR /> checkpointInterval = 5<BR /> current_only = 0<BR /> disabled = 0<BR /> index = mag_nprod<BR /> start_from = oldest</P> <P>[WinEventLog://System]<BR /> checkpointInterval = 5<BR /> current_only = 0<BR /> disabled = 0<BR /> index = mag_nprod<BR /> start_from = oldest</P> <P>The following error message is present in the Splunkd logs:</P> <P>10-09-2014 15:47:22.660 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 10-09-2014 15:47:22.660 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 10-09-2014 15:47:19.034 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 10-09-2014 15:47:18.409 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 10-09-2014 15:46:51.783 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.<BR /> 10-09-2014 15:46:27.158 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.</P> <P>Any suggestions please?</P> Mon, 28 Sep 2020 17:50:27 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191850#M38218 ankeetashet 2020-09-28T17:50:27Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191851#M38219 <P>Was there ever an answer to this? I am having the same problem. Thanks.</P> Wed, 07 Jan 2015 17:16:59 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191851#M38219 e2eadmin 2015-01-07T17:16:59Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191852#M38220 <P>Has there been answer found out for this? I am having the same problem?</P> Tue, 21 Jun 2016 03:00:30 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191852#M38220 ccraft_splunk 2016-06-21T03:00:30Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191853#M38221 <P>I'm getting the same message</P> Thu, 02 Feb 2017 08:18:53 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191853#M38221 stefan1988 2017-02-02T08:18:53Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191854#M38222 <P>bump</P> <P>we are too</P> Fri, 03 Feb 2017 20:16:15 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191854#M38222 davidboose 2017-02-03T20:16:15Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191855#M38223 <P>can you check inputs.conf and admon.conf to see that stanzas not configured by you are set to 'disabled=1'</P> <P>This error shows up because Active Directory query is not returning required values.</P> Fri, 03 Feb 2017 23:09:59 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191855#M38223 adhoke_splunk 2017-02-03T23:09:59Z https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191856#M38224 <P>I got this error as well:</P> <P>10-09-2014 15:46:27.158 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.</P> <P>Had checked the \bin directory, the splunk-admon.exe is not missing.</P> <P>Not sure what to do next though.</P> Tue, 28 Feb 2017 03:37:06 GMT https://community.splunk.com/t5/Getting-Data-In/splunkd-log-error-GetInt64Val-ldap-get-values-error/m-p/191856#M38224 season88481 2017-02-28T03:37:06Z