Is there a way to get ldapsearch to return more than 1000 entries?

[the_wolverine]

This is not directly related to Splunk.

I'm querying AD and need ldapsearch to return more than 1000 entries. How can I do this?

[waytoavnish]

In which config file we have to put above code?
I am facing same problem. One of our group is returning more than 4000 results.,

[ryanoconnor]

Does anyone know if this is yet to be implemented into SA-ldapsearch? I see an option for paged_size but I'm unsure if Splunk is using it correctly.

I have been able to get this to work from the command line ldapsearch but I haven't seen it work in Splunk..

[LincolnDeCourse]

In my current version of ldapsearch I had luck with

$ ldapsearch -h ldap.host.com -E pr=10000/noprompt -x -b "OU=Users,DC=Host,DC=Com"

[haraksin]

This worked for me on my updated version - thanks!

[the_wolverine · Accepted solution]

The real enemy is probably sizeLimit. In most cases the default sizeLimit is 1000 and any request will be capped at 1000 results.

A way to get around is getting "pages" of results.

Ldapsearch provides an option which allows you to overstep the default paged results setting which is 1000 by default. Use -E and provide a value of prX/noprompt where X is the new "pagedResults" value and 'noprompt' returns all pages without further user interaction.

$ ldapsearch -h ldap.host.com -E pr10000/noprompt -x -b "OU=Users,DC=Host,DC=Com" 

Note that this only works when run against an LDAP server (such as AD) that support paging of results.

[waytoavnish]

In which config file we have to put above code?
I am facing same problem. One of our group is returning more than 4000 results.,

[bjarnedein]

Same problem here