I have been using the same credential to login to my Splunk, but all of a sudden it stops working this afternoon. The log shows the following error. I know my password is correct because it's my AD account and I use the same pwd to login to my computer. How can I troubleshoot this login problem?
2013-04-03 14:52:55,190 ERROR [515ca4b6f952fec88] account:216 - user=xxx action=login status=failure reason=user-initiated useragent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; InfoPath.3)" clientip=xx.xx.x.xxx
Did you configure LDAP roles in Splunk for authentications? If yes, did you use LDAP search method or another utility to verify the LDAP attributes in configuring the "LDAP connection settings"
For example did you verify The Group base DN? Exaple
"OU=Security Groups - AIS,DC=ad,DC=it,DC=yourdc,DC=ext
Yes! I see the issue with AD users.
the search-heads have same error as in original question. and it is not a single server that has an issue.
This search 'index=_* "action=login status=failure" | stats count by user reason date_month date_mday date_wday date_hour host' sorts it out and I can see different users and different hosts with the error - all intermittent.
I am not sure how splunk works with DA, but have you had a look at the passwd file that holds default user details in:
Might be somewhere to start.