All Apps and Add-ons

Search Activity & Splunk Support for Active Directory: No LDAP information was found

banderson7
Communicator

I have a search head cluster, and the Search Activity app is installed outside the cluster, on my DMC. SA-Active Directory is installed, and is connected to my domains. When I go into the setup for Search Activity, and select SA-LDAPSearch, domains shows 1 of the 2 domains in the SA. Below the Domains drop-down are Update Domain and Re-run LDAPSearch buttons. Clicking either of those does nothing, and the same with Save Config Choice. Can you help w/ this please?

Thanks.

jkleensang
Path Finder

I fixed this by adding SA-ldapsearch to the import directive in local.meta

[]
access = read : [ admin ], write : [ admin ]
export = none
version = 6.5.1
modtime = 1485198715.460184000
import = search, search_activity, SA-ldapsearch

After doing this, restart or issue a debug/refresh.

0 Karma

jkleensang
Path Finder

eh - maybe I spoke too soon. I had found that (at least one) the underlying problem was ldapsearch wasn't being recognized as valid command when trying to manually run the saved search that generates the lookup. However it appears that there's something else in the mix that I'll have to check out tomorrow.

0 Karma

jkleensang
Path Finder

Came in today and now it's working. Not sure what to make of it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...