Configuring an LDAP group in Splunk 6.2.x, we're getting error "LDAP server warning:size limit exceeded". How do we increase the limit or fix this error?

[viswanathsd]

When we were trying to configure a generic LDAP group, we got this error in Splunk 6.2.x:

"LDAP server warning: size limit exceeded"

Even after increasing size limit to 30000 and 50000, we are still getting this error. Is there any other way can we increase the limit or solve this error?

[raziasaduddin]

Been there and i think there still is no fix.
They need to LDAP support for setting for the page size when doing such queries so you can enumerate through the whole list. The upper bound for a single query currently is 1500 users per LDAP group because of that.

[raziasaduddin]

You can set the LDAP related logging to debug and see what it does to confirm it is capped at 1500.

[viswanathsd]

Thanks for your response.As you said,put LDAP related logging in debug mode and checked logs,no where found Maximum sizelimit but I have seen below error message in splunkd.log...
8-19-2015 11:30:19.683 -0400 WARN ScopedLDAPConnection - strategy="LDAP_End_User" LDAP Server returned warning in search for DN="OU=Groups,DC=yyy,DC=ds,DC=xxxxx,DC=com". reason="Size limit exceeded"

As per document it defaults to 1000 even it increased it is not accepting,is there any other way?