topic Re: Error using sa-ldapsearch in Getting Data In

Error using sa-ldapsearch

jms112080 — Wed, 18 Apr 2018 21:04:15 GMT

I'm using the lastest version of the app and Splunk 7.0.1 and I've tried every suggestion I can find on the Splunk website without any luck. I get some variation of the error below. I've gone as far as modifying the python the "default" option in the python scripts to point to my domain and all it does is change the error from ldap/default to ldap/"mydomain". Anyone solved this mystery?

External search command 'ldapgroup' returned error code 1. Script output = "error_message=Missing required value for alternatedomain in ldap/default

Re: Error using sa-ldapsearch

mschlapfer — Thu, 16 Aug 2018 16:41:13 GMT

I am seeing the same error, did you ever figure out how to resolve?

Re: Error using sa-ldapsearch

msteffes — Fri, 09 Nov 2018 16:58:48 GMT

I'm seeing this message as well. I have the below ldap.conf on the search head and indexer (we also have a deployment server we don't have it on) in our environment. I have tried having stanza [domain.com] in all caps and lowercase, as well as alternatedomain = DOMAIN in all caps and lowercase. The error message I'm receiving is "External search command 'ldapfetch' returned error code 1. Script output = "error_message=Missing required value for alternatedomain in ldap/DOMAIN. " I used DOMAIN in place of our actual domain name for the example it is correct in the ldap.conf file.

[default]
server = dc1.domain.com
port = 389

[domain.com]
server = dc1.domain.com,dc2.domain.com
port = 389
ssl = false
basedn = DC=naucom,DC=com
binddn = CN=spl user,OU=Splunk,OU=System Accounts,OU=Departments and Categories,DC=domain,DC=com
password = password
alternatedomain = DOMAIN

I'm assuming either you found the answer and didn;t post it or gave up. Either way it would be nice to resolve this issue so we can fully use Splunk App for Windows Infrastructure.

Re: Error using sa-ldapsearch

louismai — Wed, 30 Sep 2020 01:54:52 GMT

I read a similar post, and followed them.
https://answers.splunk.com/answers/172847/ldapfilter-is-giving-me-error-missing-required-val.html

If you only have 1 domain, you can change that to default. It seems a work-around.
local/ldap.conf
[default]
alternatedomain=DOMAIN
basedn = dc=domain,dc=net
binddn = svc_splunk_ldap
server = ausdadc01.domain.net
ssl = 0
port = 389