Greetings,
I hope you can help with the following.
This query works when in streaming mode, but fails when the job switches to map/reduce:
index=hdpidx event.original="*\"EventId\":\"4776\"*"
| rex field=event.original "TargetUserName\":\"(?.+?)\""
| ldapfilter search="(sAMAccountNAme=$foo$)" attrs="name"
| table foo, name
It will begin returning results, but once it switches to map/red we see the following error repeated for multiple hadoop worker nodes:
[hdpprov] [w001.cluster] External search command 'ldapfilter' returned error code 1. Script output = "error_message=TypeError at "/tmp/splunk/splunk.hdpidx/splunk/var/run/searchpeers/splunk.hdpidx-1585082701/apps/SA-ldapsearch/bin/packages/splunklib/binding.py", line 478 : int() argument must be a string or a number, not 'NoneType' ".
[hdpprov] [w003.cluster] External search command 'ldapfilter' returned error code 1. Script output = "error_message=TypeError at "/tmp/splunk/splunk.hdpidx/splunk/var/run/searchpeers/splunk.hdpidx-1585082701/apps/SA-ldapsearch/bin/packages/splunklib/binding.py", line 478 : int() argument must be a string or a number, not 'NoneType' ".
... error repeated for each of the worker nodes participating in the job ...
I do not believe this is an issue with ldapfilter, but with an interaction between $var$ expansion and hunk.
If I add a head 10 directly after the initial search (before the rex), the search runs successfully - IMHO pointing to the issue only occurring during map-reduce.
I have verified worker node network access the AD servers.
Could this be an escaping issue where $foo$ is being replaced with a (non-existent) environment variable? Hence the NoneType?
Any thoughts would be much appreciated!
