ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

[Eric]

Need to some help getting my install of "Splunk for Windows Server Active Directory" app working. when I run the "User login Failures" search and click on a user that has a failed logon attempt I get these errors...

• "Lookup table 'HostInfo' is empty"
• "No Matching fields exist"
• "Error in 'script': Getinfo probe failed for external search command 'ldapsearch'"

The last error is in Red.

Ideas?

Regards,
Eric

[splunkn]

I'm having a similar isuse but the error only occurs when I try to run any of the Security > Audit > Reports.

I receive the error in red across the top:

Error in 'script': Getinfo probe failed for external search command 'ldapsearch'

Any suggestions are apprecaited.

[splunkn]

I'm running this on Windows, so I think I answered my own question. Hopefully this can help someone else who is having the same issues.

[splunkn]

Current known issues
The LDAP search commands (that install on the central Splunk App for
Active Directory instance) do not work on Windows operating systems,
owing to platform compatibility issues. As a workaround, build your central
Splunk instance around the Linux platform (MSAD-73).
·
The LDAP search commands do not work for sub-domains in an AD forest
(MSAD-105).
·
Older versions of the universal forwarder might not correctly get some
Windows events. To fix this issue, upgrade your forwarders to the latest
version. (SPL-51312)
·
52

[itfpmhtcom]

Running into the same problem here; though I'm still at the initial error - I'll try configuring Perl, but would expect to run into the second issue as well. My install is running on Debian Squeeze.

[Eric]

Moved my splunk install to *nix and still cant get this thing to work. 😞

[Eric]

Okay so I have moved a little further with this issue.. I did not have Perl configured all the way, but now I get error 255 when Perl tries to run.