Reporting

Why does SA-ldapsearch only works from search but not from savedsearch via dashbord (and it had worked before)?

JeroenDenBoer
Explorer

ls

We've got a strange issue.
At first, we had splunk 6.6.3 with SA-ldapsearch 1.2.4 that worked.
Upgraded both splunk (to 6.6.5) and the app (to 1.2.6) -> works strangely
Downgraded the app to 1.2.4 (deleted 1.2.6, and put back 1.2.4) -> same strange behavior

What happens :
We have a saved search with a query. When I enter query in a searchline , it works,
When I call it via 'settings' / ' searched, reports and alerts', it works
We have a dashboard which has a call to this saved search in one panel: that worked in the 6.6.3 Splunk / 1.2.4 SA-ldapsearch combination.

We updated Splunk, and the app (and finally downgraded the app back hoping to solve the issue), but we still have this strange issue

Opening the dashboard, we get an error :
External search command 'ldapfilter' returned error code 1. Script output = "error_message=000004DC: LdapErr: DSID-0C09079A, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0 "

Opening the underlying search (via the magnifier glass) from within this dashboard it opens a new tab with the search query, results in the same error, now it becomes weird.
Only when I push the -enter- key (nothing more), I get the desired result.

Anybody has an idea what might be causing this behavior?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...