SA-ldapsearch in Search Activity App

[ejread]

I have a working connection to AD using the Splunk Supporting Add-on for Active Directory 2.1.4. I'm able to use the |ldapsearch command in most apps, as it is shared globally with [] export=system. It works fine in the Windows infra app, nix app, etc., but not the "Search Activity" app. I get the error -

Search Factory: Unknown search command 'ldapsearch'

Permissions on the ldapsearch command are shared globally. Not sure what else might be preventing the app from using this command?

[leonphelps_s · Accepted solution]

Hello.

That error is actually caused by the Search Activity apps default.meta and local.meta settings.

I noticed that they have import values set.

default.meta:import = search,search_activity
local.meta:import = search, search_activity

It has been my experience that when you expliciltly import knowledge objects from apps.. anything NOT imported is not avaialble for use.

I've commented out the two import lines and then the search command completes correctly. You could probably just add the sa-ldapsearch app to the import line that would also fix it.

[David]

Woo! Will get this fixed in the next version.

(FWIW, I added the import limitations in response to a bug report where another app was overriding one of my macros -- my fix will be to set them to be search, search_activity, ldapsearch, sa-ldapsearch, SA-ldapsearch)

Excellent find!

[ejread]

Yes - this was a meta issue. I had to tweak the import settings. Thanks!

[rpquinlan]

"You could probably just add the sa-ldapsearch app to the import line that would also fix it. "

Commenting out those 2 lines worked for me. adding the app to the import line in the local.meta did not, however.. Until I realized it was case sensitive - "SA-ldapsearch" 😉