This might happen incase of Searchhead and Indexer clustering. By default the ldap custom commands are set to run on local machine (or SH) but incase of distributed architecture the queries are running on indexers and Indexers might not have SA-ldapsearch app installed and hence these commands would not run. Please try the below on your SH and then restart the splunk. 1) Create the local folder under SA-ldapsearch 2) Copy the commands.conf from default folder to local folder 3) Edit the commands.conf of local folder and change the parameter from "local=false" to "local=true" 4) Restart the SH If you are using the SH deployer then you need to follow the same steps on Deployer and then push the apps on SH. Please refer the below doc for the reference https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/Workaroundfordefaultconfigstanzaerrorsindistributedenvironments#Modify_SA-LDAPsearch_to_make_only_local_queries Let me know if you face any issues. Thanks, Pratik ... View more