This is not directly related to Splunk.
I'm querying AD and need ldapsearch to return more than 1000 entries. How can I do this?
The real enemy is probably sizeLimit. In most cases the default sizeLimit is 1000 and any request will be capped at 1000 results.
A way to get around is getting "pages" of results.
Ldapsearch provides an option which allows you to overstep the default paged results setting which is 1000 by default. Use -E and provide a value of prX/noprompt where X is the new "pagedResults" value and 'noprompt' returns all pages without further user interaction.
$ ldapsearch -h ldap.host.com -E pr10000/noprompt -x -b "OU=Users,DC=Host,DC=Com"
Note that this only works when run against an LDAP server (such as AD) that support paging of results.
In which config file we have to put above code?
I am facing same problem. One of our group is returning more than 4000 results.,
Does anyone know if this is yet to be implemented into SA-ldapsearch? I see an option for paged_size but I'm unsure if Splunk is using it correctly.
I have been able to get this to work from the command line ldapsearch but I haven't seen it work in Splunk..
In my current version of ldapsearch I had luck with
$ ldapsearch -h ldap.host.com -E pr=10000/noprompt -x -b "OU=Users,DC=Host,DC=Com"
The real enemy is probably sizeLimit. In most cases the default sizeLimit is 1000 and any request will be capped at 1000 results.
A way to get around is getting "pages" of results.
Ldapsearch provides an option which allows you to overstep the default paged results setting which is 1000 by default. Use -E and provide a value of prX/noprompt where X is the new "pagedResults" value and 'noprompt' returns all pages without further user interaction.
$ ldapsearch -h ldap.host.com -E pr10000/noprompt -x -b "OU=Users,DC=Host,DC=Com"
Note that this only works when run against an LDAP server (such as AD) that support paging of results.
In which config file we have to put above code?
I am facing same problem. One of our group is returning more than 4000 results.,
Same problem here