All Apps and Add-ons

Getting various errors in Splunk App for Active Directory

erstexas
Path Finder

I have followed all the steps that I sould find on installing this. I am actually getting events and most of the screens populate accurately. However, whenever I click on any of the Security > Audits or Security > Reports pages I get the following errors at the top of the screen:

Compilation failed in require at /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/bin/ldapsearch.pl line 3.

Can't locate Log/Log4perl.pm in @INC (@INC contains: /usr/lib/perl5/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/5.10.0 /usr/lib/perl5/site_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.10.0 /usr/lib/perl5/vendor_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.10.0 /usr/lib/perl5/vendor_perl .) at ActiveDirectory.pm line 18.

BEGIN failed--compilation aborted at ActiveDirectory.pm line 18.

BEGIN failed--compilation aborted at /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/bin/ldapsearch.pl line 3.

Error in 'script': Getinfo probe failed for external search command 'ldapsearch'

Any assistance? The other pages load just fine and everything else seems to work. I read in another thread about a required list of Perl modules and I haven't seem this list yet. I may be missing a module?

0 Karma
1 Solution

MarioM
Motivator

as per the app README.txt:

Configuring Perl
----------------
The ldapsearch command used throughout to obtain LDAP information uses Perl in order to be cross-platform.  You must
install Perl 5.10 (or later) and a number of modules.  perl is normally installed by default on Linux systems.  ActiveState 
(http://www.activestate.com/) provides a free community-supported version of perl.

In addition, you will need to install a number of modules.  If you do not have all required modules installed, then the
ldapsearch will generally return error code 2.  The list is as follows:

    Config::IniFiles
    Log::Dispatch::File
    Log::Log4perl
    Net::DNS
    Net::LDAP
    Text::CSV
    Time::Duration
    URI::Escape

To install a module in Windows, use:

    ppm install <module-name>

To install a module in Linux, use:

    perl -MCPAN -e "install <module-name>"

Note that dependent modules will need to be installed in both cases. There are reports that Config::IniFiles needs to have
Module::Build installed first. Ensure that all modules install successfully.  On Linux, you must be root to install modules.  
If you are running a platform other than Linux or Windows, consult your CPAN documentation on installing modules.  All the 
modules listed are pure Perl modules, so they should work cross-platform.

NOTE: At this time, running the perl commands on Windows x64 is not possible due to the following bug:

    https://rt.cpan.org/Public/Bug/Display.html?id=59790

The bug report has a diff for the broken files (which are standard files for Windows platforms and distributed with the
perl distribution).  At this time, there is no timeline for when this fix will be implemented by the author.  As a result,
we cannot recommend nor support the use of this application on Windows.

Operational logs regarding the ldapsearch command are logged in the perl.log file and available in the internal indices.

View solution in original post

MarioM
Motivator

as per the app README.txt:

Configuring Perl
----------------
The ldapsearch command used throughout to obtain LDAP information uses Perl in order to be cross-platform.  You must
install Perl 5.10 (or later) and a number of modules.  perl is normally installed by default on Linux systems.  ActiveState 
(http://www.activestate.com/) provides a free community-supported version of perl.

In addition, you will need to install a number of modules.  If you do not have all required modules installed, then the
ldapsearch will generally return error code 2.  The list is as follows:

    Config::IniFiles
    Log::Dispatch::File
    Log::Log4perl
    Net::DNS
    Net::LDAP
    Text::CSV
    Time::Duration
    URI::Escape

To install a module in Windows, use:

    ppm install <module-name>

To install a module in Linux, use:

    perl -MCPAN -e "install <module-name>"

Note that dependent modules will need to be installed in both cases. There are reports that Config::IniFiles needs to have
Module::Build installed first. Ensure that all modules install successfully.  On Linux, you must be root to install modules.  
If you are running a platform other than Linux or Windows, consult your CPAN documentation on installing modules.  All the 
modules listed are pure Perl modules, so they should work cross-platform.

NOTE: At this time, running the perl commands on Windows x64 is not possible due to the following bug:

    https://rt.cpan.org/Public/Bug/Display.html?id=59790

The bug report has a diff for the broken files (which are standard files for Windows platforms and distributed with the
perl distribution).  At this time, there is no timeline for when this fix will be implemented by the author.  As a result,
we cannot recommend nor support the use of this application on Windows.

Operational logs regarding the ldapsearch command are logged in the perl.log file and available in the internal indices.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...