Security

How to load more than 1000 records from LDAP?

Splunk Employee
Splunk Employee

How to load more than 1000 records from LDAP?

1 Solution

Splunk Employee
Splunk Employee

If you want to load more than 1000 users in Splunk manager page, there are 2 parameters to set in Splunk.

authentication.conf
sizelimit =

limits.conf
[ldap]
max_users_to_precache =
as default is 1000, normally you will just see 1000 users in the manager page.

View solution in original post

Splunk Employee
Splunk Employee

For setting more than 1000 users, the impact will be having more memory usage and slow down login time. It is better to manage with AD groups, filter those groups in authentication.conf file and select a subset of users to login to Splunk so that limited number of AD users will be "precache" in Splunk.

0 Karma

Splunk Employee
Splunk Employee

If you want to load more than 1000 users in Splunk manager page, there are 2 parameters to set in Splunk.

authentication.conf
sizelimit =

limits.conf
[ldap]
max_users_to_precache =
as default is 1000, normally you will just see 1000 users in the manager page.

View solution in original post

Builder

What are the downsides(if any) to setting size limit and max_users_to_precache to a value of 10,000? Will there be memory issues? Will things in the UI be slower to load if you expect more than 1000 users?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!