All Apps and Add-ons

Group policy changes error code 1 in Splunk App for AD?

hvandenb
Path Finder

I'm getting the following error on the Group Policy Changes: I think the issue is related to the search "search eventtype=msad-ad-access Object_Type=groupPolicyContainer | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | ldapfetch dn=Object_Name attrs=displayName | lookup tSessions local=true session_id OUTPUTNEW login_username,login_domain,login_host | fields *"

In testing "dn=Object_Name" should actually be "dn=$Object_Name$". How can have changes made to the app?

External search command 'ldapfetch' returned error code 1. First 1000 (of 2565) bytes of script output: "Access_Mask,mv_Access_Mask,Accesses,mv_Accesses,Account_Domain,mv_Account_Domain,Account_Name,mv_Account_Name,Caller_Domain,__mv_Caller_Domain,C

0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Known issue. Wait for Windows infrastructure 1.0.1.1, upgrade to 6.0 universal forwarder, then install Windows infrastructure.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Issue is fixed in Windows Infra v1.0.2. Will not be fixing this issue in AD app.

jdunlea
Contributor

Does this still stand for the current version of the SA-ldapsearch?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Known issue. Wait for Windows infrastructure 1.0.1.1, upgrade to 6.0 universal forwarder, then install Windows infrastructure.

skylasam_splunk
Splunk Employee
Splunk Employee

Thanks for reporting this issue. I've logged an internal issue and will schedule for fix in next version.

LintuMathews
Explorer

Did you guys release a Version that fixes the issue ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...