Security
Highlighted

Splunk LDAP sending huge number of searches every day

New Member

I have a splunk instance with ldap configuration.
We noticed that huge number of authentications are being done on the LDAP service using the bind dn user.
Does splunk authentication refresh the ldap strategies automatically every while?
What could the reason behind the big number of authentications?

Labels (1)
Tags (2)
0 Karma
Highlighted

Re: Splunk LDAP sending huge number of searches every day

SplunkTrust
SplunkTrust

LDAP should be configured only on instances where users sign in-typically only search heads. Make sure your indexers don't have LDAP configured.
If you have a standalone Splunk instance, consider splitting it into separate SH and indexer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Re: Splunk LDAP sending huge number of searches every day

Motivator

this can be some ldapseach command or script which is called for each result. Check if you have any of following apps/add-ons installed, and if yes, check where are they used:

  • add-on-for-ldap TA-LDAP
  • dashboard-use-cases-for-ta-ldap DA-LDAP
  • OpenLDAP Add-on for Splunk SplunkTAopenldap
  • python-ldap-technology-add-on TA-pyLDAP
  • splunkappaws
0 Karma