All Apps and Add-ons

[SA-ldapsearch] Intermittent Error on AD Identity Update

morethanyell
Builder

Hi,

We're getting an inconsistent failure on a savedsearch that comes pre-packaged with the add-on "Splunk Supporting Add-on for Active Directory". Our config is intact and has been tested connection with positive result.

This is the code of the saved search:

|ldapsearch domain=redacted.of.course search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate="" 
|table sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate,company,title,pwdLastSet
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate
| outputlookup createinapp=true mycompany_identities.csv

The error looks like this:
alt text
Tried to search what's going on with the alerts on each schedule but nothing interesting is coming up with internal logs
alt text

Does anybody know what's going on with that error?

0 Karma

amitm05
Builder

@morethanyell
This seems to be a connectivity problem as your error states
"Transport endpoint is not connected" and it is throwing a Timeout expiration exception.

Can you validate by performing the basic connectivity tests of your LDAP server from your splunk instance.
Ping, Telnet

And then first try to confirm for basic LDAP search like-
| ldapsearch domain=SPL search="(objectClass=user)"

0 Karma

amitm05
Builder

Can you apprise the status OR mark as answer if already resolved.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...