Have you read through the troubleshooting SA-Ldapsearch guid? http://docs.splunk.com/Documentation/SA-LdapSearch/latest/User/UseSA-ldapsearchtotroubleshootproblems Maybe specifically : 'Default' stanza To support context lookups in the "ldapfetch" command, you will also need a "default" stanza that lists a forest-level Global Catalog server by its IP address. In this case, you must specify the port to the Global Catalog. Following is an example: [default] server = 172.20.1.2 port = 3268 ... View more