ls We've got a strange issue. At first, we had splunk 6.6.3 with SA-ldapsearch 1.2.4 that worked. Upgraded both splunk (to 6.6.5) and the app (to 1.2.6) -> works strangely Downgraded the app to 1.2.4 (deleted 1.2.6, and put back 1.2.4) -> same strange behavior What happens : We have a saved search with a query. When I enter query in a searchline , it works, When I call it via 'settings' / ' searched, reports and alerts', it works We have a dashboard which has a call to this saved search in one panel: that worked in the 6.6.3 Splunk / 1.2.4 SA-ldapsearch combination. We updated Splunk, and the app (and finally downgraded the app back hoping to solve the issue), but we still have this strange issue Opening the dashboard, we get an error : External search command 'ldapfilter' returned error code 1. Script output = "error_message=000004DC: LdapErr: DSID-0C09079A , comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0 " Opening the underlying search (via the magnifier glass) from within this dashboard it opens a new tab with the search query, results in the same error, now it becomes weird. Only when I push the -enter- key (nothing more), I get the desired result. Anybody has an idea what might be causing this behavior? ... View more

All, i've got a strange issue regarding lookup tables. ((and seen in two lookup tables now) I have a lookup table "serialnr.csv" containing serialnumber,host,location 10,device_a,location_a 20,device_b,location_a 30,device_c,location_b This is also setup in props.conf and transforms.conf in my index only the serialnumber is seen, and recognized as serialnumber my serach contains : index=myindex | lookup serialnr.csv serialnumber as serialnumber output host as hostname | table serialnumber, hostname output looks like 20 device_b 20 device_b 10 device_a 30 device_c all info is shown and this works well for several months. I added 1 line in serialnr.csv with the info of serialnr 25 so serial.csv now contains serialnumber,host,location 10,device_a,location_a 20,device_b,location_a 25,device_d,location_c 30,device_c,location_b when i do the same search i get blank fields behind serialnumber 25, where at all other serialnumbers all info is shown. output is now 20 device_b 20 device_b 10 device_a 30 device_c 25 10 device_a 30 device_c When doing a stats, based on the result of the lookup, than the record of serialnr 25 will not show at all in the result. I have the same issue with another lookup table. I restarted all splunk servers we have in use. still the issue remains it must be something simple, but i can't figure out what. (and in the meantime our reports are missing information) Who has a clue ? ... View more