Splunk Search Head locking accounts out



I'm new to the Splunk Admin role and have a distributed environment. I have a single search head in a cluster that keeps locking an account out. We use LDAP to authenticate into Splunk and this search keeps attempting log a user in, even when they are not attempting to log in. Any idea how to fix this?

Labels (1)
0 Karma

Re: Splunk Search Head locking accounts out


Splunk and LDAP are a finicky beast. The default depth of validation is 1000. Additionally, if a LDAP user is attached to more than one Splunk role, the first one that validates terminates further validation. Meaning, if I have a valid LDAP/AD account, but have more than one Splunk account, the first one wins. Or, if I have both a valid LDAP and Splunk account, but fall beyond the default 1000 search limit, I'll never validate, since Splunk will timeout (by default settings) before finding me.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.