All Apps and Add-ons

Error when running reports in splunk for active directory


When I run any of the reports in the splunk for active directory app I get the two following errors:

  1. external search command 'ldapsearc' returned error code 1.
  2. error: java.lang.arrayindexoutofboundsexception: 17

I have installed the 1.7.7 build 11 on the splunk server. The splunk server is 2008 R2. I have checked my ldap.conf file a few times and that all seems correct. Could someone guide me where to go from here.


Splunk Employee
Splunk Employee

I suspect the java version. Can you run "java -version" and ensure it is Java SE 1.7.

Splunk Employee
Splunk Employee

Next step -

  1. Extract the ldapsearch command and run it within the search app - make sure it produces the same error (it should)
  2. Remove $SPLUNK_HOME/var/log/splunk/SA-ldapsearch.log
  3. Re-run the command, but add "debug=T" to the end to enable debug logging
  4. Check the same log file and see if there is something obvious.

If you have a support contract, please open a support case if this does not identify the issue.

0 Karma


Here is the results

java version "1.7.007"
Java(TM) SE Runtime Environment (build 1.7.0
Java HotSpot(TM) 64-Bit Server VM (build 23.3-b01, mixed mode)

I would say it looks like the correct version