All Apps and Add-ons

sa-ldapsearch: unable to use partial wildcard in LDAP queries

Path Finder


We upgraded SA-Ldapsearch from 2.1.4 to 2.2.0 and since the upgrade we are unable to do some LDAP queries using "partial" wildcards.


|ldapsearch limit=1 search="(sAMAccountName=Username)" 
|ldapsearch limit=1 search="(sAMAccountName=*)" 

Not working:

|ldapsearch limit=1 search="(sAMAccountName=User*)" 

(Note the * after part of the username)

It throws the following error:

External search command 'ldapsearch' returned error code 1. Script output = "error_message=AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 482 : Initial instance has no attribute 'hasValue' " 

Extract from the logs:

2019-02-20 13:40:41,490, Level=ERROR, Pid=8136,, Line=969, AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 482 : Initial instance has no attribute 'hasValue'  Traceback:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 593, in _process_protocol_v1  self._execute(ifile, None)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 196, in _execute  self._record_writer.write_records(self.generate())  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\", line 519, in write_records  for record in records:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\", line 105, in generate  for entry in entry_generator:  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\extend\standard\", line 64, in paged_search_generator  None if cookie is True else cookie)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\core\", line 779, in search  response = self.post_send_search(self.send('searchRequest', request, controls))  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\", line 303, in send  self.connection.request = BaseStrategy.decode_request(message_type, request, controls)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\", line 635, in decode_request  result = search_request_to_dict(component)  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 520, in search_request_to_dict  'filter': filter_to_string(request['filter']),  File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\", line 482, in filter_to_string  if substring[component] is not None and substring[component].hasValue():

It was working fine with the 2.1.x version of the App.

I opened a case with support (1287612) and will update on results.



Any news on this? We have the same problem and still no new version. I wont change anything in the code. Whats about a fixed app version, splunk?,

Path Finder

Confirmed workaround is to revert the old part of the problematic function in

alt text
alt text

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...