LDAP Search Query Error Messages - Error Code 1.

[jhampton3rd]

After running the following query:

| ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(objectclass=group)" attrs="cn,description,primaryGroupToken" 
| eval joiner=mvappend(dn,primaryGroupToken) 
| rename dn as groupDN,cn as groupName,primaryGroupToken as primaryGroupID 
| table groupDN,groupName,primaryGroupID,joiner 
| mvexpand joiner 
| join type=inner joiner 
    [ ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(sAMAccountName=*)" attrs="memberOf,primaryGroupID" 
    | eval joiner=mvappend(memberOf,primaryGroupID) 
    | table joiner 
    | mvexpand joiner] 
| dedup groupDN 
| table groupDN,groupName,primaryGroupID 
| sort primaryGroupID

I receive the following error messages with no results found:

• External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "

• [drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [subsearch]: External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "

• [subsearch]: [drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [subsearch]: [drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [subsearch]: [drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [subsearch]: [wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [subsearch]: [wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [subsearch]: [wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

• [wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "

Can't seem to figure out how to fix this error message. Thanks in advance for your help.

[parthiv]

Hi ,

Please check your ldap.conf . it must have stanza of mydomain in your case.
For further details please read the following link.

http://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/ConfiguretheSplunkSupportingAdd-onforA...

[damode]

Does the [credential:SA-ldapsearch:default:] stanza from the passwords.conf file have to match in both S.H and Indexer ?

I am also getting this same error,

External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""C:\Program Files\Splunk\var\run\searchpeers\my-search-head-15318\apps\SA-ldapsearch\bin\packages\splunklib\client.py"", line 1653 : u'ldap'" "

[richgalloway]

@damode, please post a new question for help with your problem.

[alemarzu]

Hi there @jhampton3rd

Don't use wildcards on domain nor basedn parameter.

[richgalloway]

The first error message seems key: "Cannot find the configuration stanza for domain=mydomain in ldap.conf". Have you checked your ldap.conf file?