All Apps and Add-ons

Script error during SA-ldapsearch test connection


I need help getting started with SA-ldapsearch because there are no results returned during the test connection phase of SA-ldapsearch configuration. Test connection starts the search:

| ldapsearch domain="default" scope=base search="(objectClass=*)" attrs="distinguishedName"

The events showing the error in the SA-ldapsearch.log file are:

2014-10-25 08:04:55,375, Level=ERROR, Pid=7872,, Line=342, Traceback (most recent call last):
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 316, in process
    self._execute(operation, reader, writer)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 79, in _execute
    for record in operation():
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\", line 79, in generate
    configuration = app.Configuration(self)
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\", line 42, in __init__
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\", line 149, in _read_configuration
    settings = self._read_default_configuration()
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\", line 177, in _read_default_configuration
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\app\", line 177, in <dictcomp>
    settings = {entry[u'title']: entry[u'content'][u'$text'] for entry in entries} if entries else {}
  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\", line 245, in __getitem__
    raise KeyError("No key or prefix: %s" % key)

KeyError: u'No key or prefix: $text.'

The scrubbed (so many subdomains) ldap.conf file is:

alternatedomain = MAINDOMAIN
basedn = dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
binddn = cn=doctor.whom,OU=OU1,OU=OU2,OU=OU3,dc=maindomain,dc=dc1,dc=dc2,dc=dc3,dc=dc4,dc=us
password = 
port = 389
server =
ssl = 0

The password was entered in the configuration form in Base-64 and appears to have been moved to app.conf. I'm using a trial version on Splunk Enterprise Version 6.1.3 provided by Splunk sales on a Windows 7 PC. SA-ldapsearch app was downloaded 10/15/2014. I have not been able to find the version.


Path Finder

Delete the "SA-ldapsearch" directory from "$SPLUNK_HOME/etc/apps" and restart Splunk.

Go to Add-Ons, reinstall the SA-ldapsearch addon, restart Splunk.

Reconfigure the Addon using its configuration page and it should work.

Splunk Employee
Splunk Employee

Thanks this worked! Do you know why the new SA-ldapsearch exhibits this behavior? Just curious.

0 Karma

Path Finder

My best guess is that the upgrade (I'm assuming you upgraded from a previous version too) process failed to properly clean the environment for the new version. Glad it's working for you!

0 Karma

Splunk Employee
Splunk Employee

Gotcha. I was not the person whom installed it on the system, so I am not sure if it was an upgrade. Although I did notice the UI config changes were properly reflected on the local/ldap.conf file. Strange.

0 Karma


Same problems with the new version (v 2.0) over here... nothing works 😞

0 Karma

Path Finder

** EDIT: I uninstalled and reinstalled the addon and it fixed the problem.

I'm also running into this issue on with an indexer running Splunk 6.2.0 on 64-bit Ubuntu with SA-ldapsearch v 2.0.1. I get the exact same error text.

Here's my scrubbed config:
server =
port = 3268
basedn = DC=ad,DC=department,DC=school,DC=edu
binddn = CN=splunk_user,OU=Admin,OU=ABCDE,DC=ad,DC=department,DC=school,DC=edu
password =
alternatedomain = AD
ssl = 0

There is a Base-64 password in app.conf.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!