All Apps and Add-ons

[SA-ldapsearch] Intermittent Error on AD Identity Update

morethanyell
Builder

Hi,

We're getting an inconsistent failure on a savedsearch that comes pre-packaged with the add-on "Splunk Supporting Add-on for Active Directory". Our config is intact and has been tested connection with positive result.

This is the code of the saved search:

|ldapsearch domain=redacted.of.course search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate="" 
|table sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate,company,title,pwdLastSet
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate
| outputlookup createinapp=true mycompany_identities.csv

The error looks like this:
alt text
Tried to search what's going on with the alerts on each schedule but nothing interesting is coming up with internal logs
alt text

Does anybody know what's going on with that error?

0 Karma

amitm05
Builder

@morethanyell
This seems to be a connectivity problem as your error states
"Transport endpoint is not connected" and it is throwing a Timeout expiration exception.

Can you validate by performing the basic connectivity tests of your LDAP server from your splunk instance.
Ping, Telnet

And then first try to confirm for basic LDAP search like-
| ldapsearch domain=SPL search="(objectClass=user)"

0 Karma

amitm05
Builder

Can you apprise the status OR mark as answer if already resolved.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...