LDAP connection with AD group group with 3K + plus users

[Gowthamdevaraj]

Hello Together,

I have AD Group with 3000 plus users to be added in to LDAP settings in to splunk, But Users are not getting loaded when in connect the AD Group.

At the same time, if i use AD Groups with less user and then Iam able to see the users in splunk.

I use the following command in my configuration
user base DN = dc=abc,dc=com
userbase filter = (objectClass=user)
Group Base DN = dc=abc,dc=com

Static group search filter = (&(objectClass=group)(|(cn=AB_01_Splunk_users)(cn=AB_02_domainUsers)))

Group name attribute = cn

AB_02_domainUsers has 3000 plus users and where as AB_01_Splunk_users has only 50 users.

CN for groups as :
CN=AB_01_Splunk_users,OU=Securitygroups,OU=Itspmg,OU=Applications,DC=abc,DC=com

CN=AB_02_domainUsers,CN=Users,DC=in,DC=abc,DC=com

Thanks

[PavelP]

google for "ldap 1000 record limit", this can be the cause.

There is a maxPageSize limit of 1000 in the windows AD which limits the LDAP query records to a max of 1000. In simple words whenever an LDAP search or query is made to the AD, no more than 1000 records are returned from the directory

you have to narrow your query to be below 1000 results or adjust ldap settings on the AD side to lift this restiction.