Weird issue with LDAP users and saved searches

Path Finder


I've been having issues with saved searches not displaying properly. The strange thing is that this only applies to some searches and only for LDAP users.

For example the search string:

source="WinEventLog:Security" host=snzclakl098 eventid = 4625 | stats count by AccountName

Works fine normally but when saved as a search and re-run gives this error - not enough karma to upload pictures 😞

[SimpleResultsTable module] [HTTP 404] lyeW9uZyBseQsearchtestsearch1347410436.4208/resultspreview?count=50&timeformat=%25s.%25Q&outputtimeformat=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&output_mode=xml; [{'text': 'Unknown sid.', 'code': None, 'type': 'FATAL'}]

what's weird is that this only applies to LDAP users, where as if I use a local user there's no problem.

Is it something to do with the fact that it's a flashtimeline search but it's got the stats command? I notice that without the stats command the searches are fine.. but any kind of tabling or charting seems to have issues.. again only for LDAP users.

Anyone have any ideas?

Tags (2)
0 Karma

Re: Weird issue with LDAP users and saved searches

Path Finder

so for anyone who sees this, we worked it out to be the space in between the user names that caused the issues. Apparently this will be fixed in a couple of releases time.

0 Karma