Our initial install of the MS Windows AD Objects App was successful and the build searches were successful. However, recently the AD Group rebuild search is failing on the last line item of the search:
| outputlookup AD_Obj_Group
While the search seems to complete, it completes with the following error:
Error in 'outputlookup' command: Could not write to collection '__AD_Obj_Group_LDAP_list_kv': An error occurred while saving to the KV Store. Look at search.log for more information.
In looking at the search job, I am also seeing the following error:
ERROR FastTyper [30728 localCollectorThread] - caught exception in eventtyper, search='(index=index1 OR index2 OR index=index3source="*:System" "Installation Failure")' in event typer: err='Comparator '=' has an invalid term on the left hand side: index=index=index3source"
For the above error I know where the issue is in the search, but I do not know where this configuration is with-in Splunk Cloud to correct it.
Thoughts on how to correct the outputlook and/or the search term?
Thanks.
Jimmy
