Splunk LDAP sending huge number of searches every day

New Member

I have a splunk instance with ldap configuration.
We noticed that huge number of authentications are being done on the LDAP service using the bind dn user.
Does splunk authentication refresh the ldap strategies automatically every while?
What could the reason behind the big number of authentications?

Labels (1)
Tags (2)
0 Karma


this can be some ldapseach command or script which is called for each result. Check if you have any of following apps/add-ons installed, and if yes, check where are they used:

  • add-on-for-ldap TA-LDAP
  • dashboard-use-cases-for-ta-ldap DA-LDAP
  • OpenLDAP Add-on for Splunk Splunk_TA_openldap
  • python-ldap-technology-add-on TA-pyLDAP
  • splunk_app_aws
0 Karma


LDAP should be configured only on instances where users sign in-typically only search heads. Make sure your indexers don't have LDAP configured.
If you have a standalone Splunk instance, consider splitting it into separate SH and indexer.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!