Running 9.2 and getting the same error ... View more

Depending on your AD implementation, and the number of users associated, you are likely hitting a search limit. When validating against LDAP, Splunk will timeout based on several parameters. Number of users (1000 by default), search and network timeout settings, etc. If you have a large number of users, you are most likely hitting a limit before Splunk is able to find/validate the specific user. https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/ConfigureLDAPwithSplunkWeb ... View more

Hi @flyers777, you could run a script that extract the size of files using a simple dir command (in Windows) or an ls -la command (in Linux) sending the output to Splunk, then you can run a search that compares values alerting it it reach a threeshold. You can find infos at https://docs.splunk.com/Documentation/Splunk/8.0.1/AdvancedDev/ScriptSetup but in few words: you have to create a script in $SPLUNK_HOME/etc/apps/your_app/bin e.g. called ls.sh (in Linux), give to the script the correct execution rights, create a stanza in inputs.conf to schedule script. Ciao. Giuseppe ... View more