topic Re: Not able to access splunk in Splunk Search

Not able to access splunk

gajananh999 — Tue, 15 Jul 2014 10:01:49 GMT

Dear All,

We have splunk search head with 100's of user in it. But suddenly this morning what happened i dont know but none of user is not able to login. I can only login with Splunk admin account may i know what is the issue for this?

Thanks
Gajanan

Re: Not able to access splunk

martin_mueller — Tue, 15 Jul 2014 10:06:12 GMT

Check your license messages. Either click Messages if nobody deleted them yet, or go to Settings -> Licensing and see what that says.

Re: Not able to access splunk

gajananh999 — Tue, 15 Jul 2014 10:18:14 GMT

Thanks for your reply.There is No licensing alerts.

Re: Not able to access splunk

martin_mueller — Tue, 15 Jul 2014 10:19:02 GMT

So the licensing page tells you your license is valid? Great.

Do you use external authentication, such as LDAP/AD/etc.?

Re: Not able to access splunk

gajananh999 — Tue, 15 Jul 2014 10:26:59 GMT

Yes we use LDAP

Re: Not able to access splunk

martin_mueller — Tue, 15 Jul 2014 10:29:41 GMT

Check if that's working as it should.

For example, search the _internal index for LDAP*.

Re: Not able to access splunk

gajananh999 — Tue, 15 Jul 2014 10:31:59 GMT

index=_internal LDAP* its not giving any result..

Re: Not able to access splunk

martin_mueller — Tue, 15 Jul 2014 10:35:31 GMT

Oops, try *LDAP*. Alternatively, take the time of a failed attempt and look at everything that happened around that time.

Re: Not able to access splunk

gajananh999 — Tue, 15 Jul 2014 10:36:05 GMT

Dear Martin its working fine its giving me a result.

Re: Not able to access splunk

gajananh999 — Tue, 15 Jul 2014 10:39:02 GMT

Martin.. 07-15-2014 06:23:33.216 -0400 ERROR UserManagerPro - Failed to get LDAP user="m8000" from any configured servers

Re: Not able to access splunk

martin_mueller — Tue, 15 Jul 2014 10:52:44 GMT

Sounds like that's your problem. Check the user exists obviously, and that Splunk can connect to the server.

What version are you using, and on what OS?

Re: Not able to access splunk

gajananh999 — Tue, 15 Jul 2014 11:15:22 GMT

No one able to login. its Windows machine with splunk 6.0.2

Re: Not able to access splunk

jimodonald — Tue, 15 Jul 2014 12:26:24 GMT

Check to see if the service account is locked out on the LDAP server.

Re: Not able to access splunk

martin_mueller — Tue, 15 Jul 2014 12:26:56 GMT

What happens when you log in as local admin user and go to Settings -> Authentication -> Authentication Method -> Configure ... LDAP ... groups -> Your LDAP Strategy -> Map Groups?

My working hypothesis is that your Splunk instance cannot connect with your LDAP for some reason.