Alerting

LDAP authenticated users do not pick up mail attribute from AD?

jeff
Contributor

Splunk 4.1. I configured LDAP authentication, pointing to our AD domain controller. The users get mapped to roles successfully, but I examine the user's attributes under Manager>>Access controls>>Users>>juser, Email address is blank (and uneditable). The user is also unable to edit their own email preferences.

How can I enable emailed alerts/reports for these users?

Tags (3)
1 Solution

the_wolverine
Champion

Scheduled alerts are configurable by the Splunk user. The alerts can be configured to send email to any email address and Splunk does not assume that the configured alert is sent to the user who created the alert.

Currently Splunk does not provide the built-in capability to map the email attribute. If you have a use-case for this, feel free to file an Enhancement Request.

View solution in original post

jspears
Communicator

In 4.3 there appears to be a default option to email a link to the results of backgrounded searches when they complete. Presently on our system, only admin can take advantage of this capability because normal users are all in LDAP, with no way to populate their email field. So by opting to use LDAP authentication, we're missing out on some nice functionality in the core product.

the_wolverine
Champion

Yes this is definitely a very nice feature to have for any user who is backgrounding searches.

0 Karma

the_wolverine
Champion

Scheduled alerts are configurable by the Splunk user. The alerts can be configured to send email to any email address and Splunk does not assume that the configured alert is sent to the user who created the alert.

Currently Splunk does not provide the built-in capability to map the email attribute. If you have a use-case for this, feel free to file an Enhancement Request.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!