All Apps and Add-ons

Group policy changes error code 1 in Splunk App for AD?

Path Finder

I'm getting the following error on the Group Policy Changes: I think the issue is related to the search "search eventtype=msad-ad-access Object_Type=groupPolicyContainer | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | ldapfetch dn=Object_Name attrs=displayName | lookup tSessions local=true session_id OUTPUTNEW login_username,login_domain,login_host | fields *"

In testing "dn=Object_Name" should actually be "dn=$Object_Name$". How can have changes made to the app?

External search command 'ldapfetch' returned error code 1. First 1000 (of 2565) bytes of script output: "Access_Mask,mv_Access_Mask,Accesses,mv_Accesses,Account_Domain,mv_Account_Domain,Account_Name,mv_Account_Name,Caller_Domain,__mv_Caller_Domain,C

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Known issue. Wait for Windows infrastructure 1.0.1.1, upgrade to 6.0 universal forwarder, then install Windows infrastructure.

View solution in original post

Splunk Employee
Splunk Employee

Issue is fixed in Windows Infra v1.0.2. Will not be fixing this issue in AD app.

Path Finder

Does this still stand for the current version of the SA-ldapsearch?

0 Karma

Splunk Employee
Splunk Employee

Known issue. Wait for Windows infrastructure 1.0.1.1, upgrade to 6.0 universal forwarder, then install Windows infrastructure.

View solution in original post

Splunk Employee
Splunk Employee

Thanks for reporting this issue. I've logged an internal issue and will schedule for fix in next version.

Explorer

Did you guys release a Version that fixes the issue ?

0 Karma