All Apps and Add-ons

LDAP Search Query Error Messages - Error Code 1.

Explorer

After running the following query:

| ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(objectclass=group)" attrs="cn,description,primaryGroupToken" 
| eval joiner=mvappend(dn,primaryGroupToken) 
| rename dn as groupDN,cn as groupName,primaryGroupToken as primaryGroupID 
| table groupDN,groupName,primaryGroupID,joiner 
| mvexpand joiner 
| join type=inner joiner 
    [ ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(sAMAccountName=*)" attrs="memberOf,primaryGroupID" 
    | eval joiner=mvappend(memberOf,primaryGroupID) 
    | table joiner 
    | mvexpand joiner] 
| dedup groupDN 
| table groupDN,groupName,primaryGroupID 
| sort primaryGroupID

I receive the following error messages with no results found:

  • External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "

  • [drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [subsearch]: External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "

  • [subsearch]: [drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [subsearch]: [drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [subsearch]: [drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [subsearch]: [wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [subsearch]: [wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [subsearch]: [wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

  • [wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

Can't seem to figure out how to fix this error message. Thanks in advance for your help.

0 Karma

Explorer

Hi ,

Please check your ldap.conf . it must have stanza of mydomain in your case.
For further details please read the following link.

http://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/ConfiguretheSplunkSupportingAdd-onforA...

0 Karma

Motivator

Does the [credential:SA-ldapsearch:default:] stanza from the passwords.conf file have to match in both S.H and Indexer ?

I am also getting this same error,

External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""C:\Program Files\Splunk\var\run\searchpeers\my-search-head-15318\apps\SA-ldapsearch\bin\packages\splunklib\client.py"", line 1653 : u'ldap'" "

0 Karma

SplunkTrust
SplunkTrust

@damode, please post a new question for help with your problem.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Motivator

Hi there @jhampton3rd

Don't use wildcards on domain nor basedn parameter.

0 Karma

SplunkTrust
SplunkTrust

The first error message seems key: "Cannot find the configuration stanza for domain=mydomain in ldap.conf". Have you checked your ldap.conf file?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!