Not able to access splunk

[gajananh999]

Dear All,

We have splunk search head with 100's of user in it. But suddenly this morning what happened i dont know but none of user is not able to login. I can only login with Splunk admin account may i know what is the issue for this?

Thanks
Gajanan

[martin_mueller]

What happens when you log in as local admin user and go to Settings -> Authentication -> Authentication Method -> Configure ... LDAP ... groups -> Your LDAP Strategy -> Map Groups?

My working hypothesis is that your Splunk instance cannot connect with your LDAP for some reason.

[jimodonald]

Check to see if the service account is locked out on the LDAP server.

[gajananh999]

No one able to login. its Windows machine with splunk 6.0.2

[martin_mueller]

Sounds like that's your problem. Check the user exists obviously, and that Splunk can connect to the server.

What version are you using, and on what OS?

[gajananh999]

Martin.. 07-15-2014 06:23:33.216 -0400 ERROR UserManagerPro - Failed to get LDAP user="m8000" from any configured servers

[gajananh999]

Dear Martin its working fine its giving me a result.

[martin_mueller]

Oops, try *LDAP*. Alternatively, take the time of a failed attempt and look at everything that happened around that time.

[gajananh999]

index=_internal LDAP* its not giving any result..

[martin_mueller]

Check if that's working as it should.

For example, search the _internal index for LDAP*.

[gajananh999]

Yes we use LDAP

[martin_mueller]

So the licensing page tells you your license is valid? Great.

Do you use external authentication, such as LDAP/AD/etc.?

[gajananh999]

Thanks for your reply.There is No licensing alerts.

[martin_mueller]

Check your license messages. Either click Messages if nobody deleted them yet, or go to Settings -> Licensing and see what that says.