Need to some help getting my install of "Splunk for Windows Server Active Directory" app working. when I run the "User login Failures" search and click on a user that has a failed logon attempt I get these errors...
The last error is in Red.
I'm having a similar isuse but the error only occurs when I try to run any of the Security > Audit > Reports.
I receive the error in red across the top:
Error in 'script': Getinfo probe failed for external search command 'ldapsearch'
Any suggestions are apprecaited.
Current known issues
The LDAP search commands (that install on the central Splunk App for
Active Directory instance) do not work on Windows operating systems,
owing to platform compatibility issues. As a workaround, build your central
Splunk instance around the Linux platform (MSAD-73).
The LDAP search commands do not work for sub-domains in an AD forest
Older versions of the universal forwarder might not correctly get some
Windows events. To fix this issue, upgrade your forwarders to the latest
Running into the same problem here; though I'm still at the initial error - I'll try configuring Perl, but would expect to run into the second issue as well. My install is running on Debian Squeeze.