All Apps and Add-ons

Splunk Supporting Add-on for Active Directory: Why is a simple ldapsearch search slow to return results?

_smp_
Builder

First let me say I'm no Active Directory expert so maybe this behavior is expected. But I have successfully installed the Splunk Supporting Add-on for Active Directory and tested the connection. When I run a simple search, there's a relatively long (~10s) delay before the results are returned. Here's what my search looks like:

| ldapsearch domain=ACME search="(&(objectClass=user)(samAccountName=george))" attrs="department"

The search takes about 9 seconds, which seemed strange to me so I took a packet capture. After the bind, it looks like the add-on is sending a subSchema search for 12 attributes. A couple of those attributes (dITContentRules and attributeTypes) have a lot of values - 647 and 4108 respectively. It's the transmission of these attribute values that is causing the search to take so long. Once the add-in sends the actual search based on my search term, the response is almost immediate.

Is it normal for the add-on to send that initial subSchema query? Is there some reason it's necessary, or some way to suppress it?

0 Karma

pappjr
Path Finder

Hi @scottprigge,

The Splunk Supporting Add-on for Active Directory is notorious for taking unusually long to return results. I have seen similar issues myself in just about every client environment I've used it in. Attached is the most descriptive thread of fellow Splunkers lamenting this issue:

https://answers.splunk.com/answers/329748/how-do-i-improve-ldapsearch-performance.html

Sounds like this is an issue for the developers, maybe you could open a ticket with your findings and help push them along?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...