topic Re: OpenLDAP add-on fields extraction in Splunk Enterprise Security

OpenLDAP add-on fields extraction

kevinleeV — Fri, 29 Jun 2018 00:41:14 GMT

I recently installed openldap add-on on both splunk cloud instance and splunk enterprise security instance

However, the fields extraction only occurs within splunk cloud instance, not ES. How does this happen? What would be a fix for this?

kthammireddygar — Fri, 29 Jun 2018 06:27:29 GMT

i assume you have done debug/refresh.

Search :
index=yourindex sourcetype=ldap modifiersname=*

try this search on both the instances.

kchamplin_splun — Fri, 29 Jun 2018 15:19:44 GMT

This is likely due to app-imports-update mod input not configured to accept the OpenLDAP app name:
https://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps

kevinleeV — Fri, 29 Jun 2018 16:45:03 GMT

When your modifiedersname is searched in ES, no results get returned, while you get a bunch of data within Splunk cloud

kevinleeV — Tue, 29 Sep 2020 20:13:50 GMT

I can see Splunk_TA_openldap being imported within ES when below command is performed. Seems like apps are being imported

| rest /servicesNS/admin/system/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local | fields import

kthammireddygar — Fri, 29 Jun 2018 17:46:57 GMT

Can you please check Permissions for openldap add-on?
Is it Private or Global or App?
Please make it Global.

kevinleeV — Fri, 29 Jun 2018 20:18:09 GMT

It was set to App and I changed to Global. However, there is no difference in fields extraction.