All Apps and Add-ons

[SA-ldapsearch] Intermittent Error on AD Identity Update

morethanyell
Builder

Hi,

We're getting an inconsistent failure on a savedsearch that comes pre-packaged with the add-on "Splunk Supporting Add-on for Active Directory". Our config is intact and has been tested connection with positive result.

This is the code of the saved search:

|ldapsearch domain=redacted.of.course search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate="" 
|table sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate,company,title,pwdLastSet
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate
| outputlookup createinapp=true mycompany_identities.csv

The error looks like this:
alt text
Tried to search what's going on with the alerts on each schedule but nothing interesting is coming up with internal logs
alt text

Does anybody know what's going on with that error?

0 Karma

amitm05
Builder

@morethanyell
This seems to be a connectivity problem as your error states
"Transport endpoint is not connected" and it is throwing a Timeout expiration exception.

Can you validate by performing the basic connectivity tests of your LDAP server from your splunk instance.
Ping, Telnet

And then first try to confirm for basic LDAP search like-
| ldapsearch domain=SPL search="(objectClass=user)"

0 Karma

amitm05
Builder

Can you apprise the status OR mark as answer if already resolved.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...