All Apps and Add-ons

Splunk Supporting Add-on for Active Directory: Why is a simple ldapsearch search slow to return results?


First let me say I'm no Active Directory expert so maybe this behavior is expected. But I have successfully installed the Splunk Supporting Add-on for Active Directory and tested the connection. When I run a simple search, there's a relatively long (~10s) delay before the results are returned. Here's what my search looks like:

| ldapsearch domain=ACME search="(&(objectClass=user)(samAccountName=george))" attrs="department"

The search takes about 9 seconds, which seemed strange to me so I took a packet capture. After the bind, it looks like the add-on is sending a subSchema search for 12 attributes. A couple of those attributes (dITContentRules and attributeTypes) have a lot of values - 647 and 4108 respectively. It's the transmission of these attribute values that is causing the search to take so long. Once the add-in sends the actual search based on my search term, the response is almost immediate.

Is it normal for the add-on to send that initial subSchema query? Is there some reason it's necessary, or some way to suppress it?

0 Karma

Path Finder

Hi @scottprigge,

The Splunk Supporting Add-on for Active Directory is notorious for taking unusually long to return results. I have seen similar issues myself in just about every client environment I've used it in. Attached is the most descriptive thread of fellow Splunkers lamenting this issue:

Sounds like this is an issue for the developers, maybe you could open a ticket with your findings and help push them along?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...