All Apps and Add-ons

[SA-ldapsearch] Intermittent Error on AD Identity Update



We're getting an inconsistent failure on a savedsearch that comes pre-packaged with the add-on "Splunk Supporting Add-on for Active Directory". Our config is intact and has been tested connection with positive result.

This is the code of the saved search:

|ldapsearch domain=redacted.of.course search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate="" 
|table sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate,company,title,pwdLastSet
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate
| outputlookup createinapp=true mycompany_identities.csv

The error looks like this:
alt text
Tried to search what's going on with the alerts on each schedule but nothing interesting is coming up with internal logs
alt text

Does anybody know what's going on with that error?

0 Karma


This seems to be a connectivity problem as your error states
"Transport endpoint is not connected" and it is throwing a Timeout expiration exception.

Can you validate by performing the basic connectivity tests of your LDAP server from your splunk instance.
Ping, Telnet

And then first try to confirm for basic LDAP search like-
| ldapsearch domain=SPL search="(objectClass=user)"

0 Karma


Can you apprise the status OR mark as answer if already resolved.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...