All Apps and Add-ons

Is there a way to get ldapsearch to return more than 1000 entries?

the_wolverine
Champion

This is not directly related to Splunk.

I'm querying AD and need ldapsearch to return more than 1000 entries. How can I do this?

Tags (2)
1 Solution

the_wolverine
Champion

The real enemy is probably sizeLimit. In most cases the default sizeLimit is 1000 and any request will be capped at 1000 results.

A way to get around is getting "pages" of results.

Ldapsearch provides an option which allows you to overstep the default paged results setting which is 1000 by default. Use -E and provide a value of prX/noprompt where X is the new "pagedResults" value and 'noprompt' returns all pages without further user interaction.

$ ldapsearch -h ldap.host.com -E pr10000/noprompt -x -b "OU=Users,DC=Host,DC=Com" 

Note that this only works when run against an LDAP server (such as AD) that support paging of results.

View solution in original post

waytoavnish
Explorer

In which config file we have to put above code?
I am facing same problem. One of our group is returning more than 4000 results.,

0 Karma

ryanoconnor
Builder

Does anyone know if this is yet to be implemented into SA-ldapsearch? I see an option for paged_size but I'm unsure if Splunk is using it correctly.

I have been able to get this to work from the command line ldapsearch but I haven't seen it work in Splunk..

0 Karma

LincolnDeCourse
Engager

In my current version of ldapsearch I had luck with

$ ldapsearch -h ldap.host.com -E pr=10000/noprompt -x -b "OU=Users,DC=Host,DC=Com"

the_wolverine
Champion

The real enemy is probably sizeLimit. In most cases the default sizeLimit is 1000 and any request will be capped at 1000 results.

A way to get around is getting "pages" of results.

Ldapsearch provides an option which allows you to overstep the default paged results setting which is 1000 by default. Use -E and provide a value of prX/noprompt where X is the new "pagedResults" value and 'noprompt' returns all pages without further user interaction.

$ ldapsearch -h ldap.host.com -E pr10000/noprompt -x -b "OU=Users,DC=Host,DC=Com" 

Note that this only works when run against an LDAP server (such as AD) that support paging of results.

View solution in original post

waytoavnish
Explorer

In which config file we have to put above code?
I am facing same problem. One of our group is returning more than 4000 results.,

0 Karma

bjarnedein
Explorer

Same problem here

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!