All Apps and Add-ons

MS Windows AD Objects App - AD Group Build Failing

j_brown
Observer

Our initial install of the MS Windows AD Objects App was successful and the build searches were successful. However, recently the AD Group rebuild search is failing on the last line item of the search:
| outputlookup AD_Obj_Group

While the search seems to complete, it completes with the following error:
Error in 'outputlookup' command: Could not write to collection '__AD_Obj_Group_LDAP_list_kv': An error occurred while saving to the KV Store. Look at search.log for more information.

In looking at the search job, I am also seeing the following error:
ERROR FastTyper [30728 localCollectorThread] - caught exception in eventtyper, search='(index=index1 OR index2 OR index=index3source="*:System" "Installation Failure")' in event typer: err='Comparator '=' has an invalid term on the left hand side: index=index=index3source"

For the above error I know where the issue is in the search, but I do not know where this configuration is with-in Splunk Cloud to correct it.

Thoughts on how to correct the outputlook and/or the search term?

Thanks.
Jimmy

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...