Splunk LDAP sending huge number of searches every day

[ad077]

I have a splunk instance with ldap configuration.
We noticed that huge number of authentications are being done on the LDAP service using the bind dn user.
Does splunk authentication refresh the ldap strategies automatically every while?
What could the reason behind the big number of authentications?

[PavelP]

this can be some ldapseach command or script which is called for each result. Check if you have any of following apps/add-ons installed, and if yes, check where are they used:

• add-on-for-ldap TA-LDAP
• dashboard-use-cases-for-ta-ldap DA-LDAP
• OpenLDAP Add-on for Splunk Splunk_TA_openldap
• python-ldap-technology-add-on TA-pyLDAP
• splunk_app_aws

[richgalloway]

LDAP should be configured only on instances where users sign in-typically only search heads. Make sure your indexers don't have LDAP configured.
If you have a standalone Splunk instance, consider splitting it into separate SH and indexer.