Group policy changes error code 1 in Splunk App for AD?

[hvandenb]

I'm getting the following error on the Group Policy Changes: I think the issue is related to the search "search eventtype=msad-ad-access Object_Type=groupPolicyContainer | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | ldapfetch dn=Object_Name attrs=displayName | lookup tSessions local=true session_id OUTPUTNEW login_username,login_domain,login_host | fields *"

In testing "dn=Object_Name" should actually be "dn=$Object_Name$". How can have changes made to the app?

External search command 'ldapfetch' returned error code 1. First 1000 (of 2565) bytes of script output: "Access_Mask,mv_Access_Mask,Accesses,mv_Accesses,Account_Domain,mv_Account_Domain,Account_Name,mv_Account_Name,Caller_Domain,__mv_Caller_Domain,C

[rbal_splunk]

Issue is fixed in Windows Infra v1.0.2. Will not be fixing this issue in AD app.

[jdunlea]

Does this still stand for the current version of the SA-ldapsearch?

[rbal_splunk · Accepted solution]

Known issue. Wait for Windows infrastructure 1.0.1.1, upgrade to 6.0 universal forwarder, then install Windows infrastructure.

[skylasam_splunk]

Thanks for reporting this issue. I've logged an internal issue and will schedule for fix in next version.

[LintuMathews]

Did you guys release a Version that fixes the issue ?