All Apps and Add-ons

MS Windows AD Objects App - AD Group Build Failing


Our initial install of the MS Windows AD Objects App was successful and the build searches were successful. However, recently the AD Group rebuild search is failing on the last line item of the search:
| outputlookup AD_Obj_Group

While the search seems to complete, it completes with the following error:
Error in 'outputlookup' command: Could not write to collection '__AD_Obj_Group_LDAP_list_kv': An error occurred while saving to the KV Store. Look at search.log for more information.

In looking at the search job, I am also seeing the following error:
ERROR FastTyper [30728 localCollectorThread] - caught exception in eventtyper, search='(index=index1 OR index2 OR index=index3source="*:System" "Installation Failure")' in event typer: err='Comparator '=' has an invalid term on the left hand side: index=index=index3source"

For the above error I know where the issue is in the search, but I do not know where this configuration is with-in Splunk Cloud to correct it.

Thoughts on how to correct the outputlook and/or the search term?



Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...