All Apps and Add-ons

Group policy changes error code 1 in Splunk App for AD?

hvandenb
Path Finder

I'm getting the following error on the Group Policy Changes: I think the issue is related to the search "search eventtype=msad-ad-access Object_Type=groupPolicyContainer | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | ldapfetch dn=Object_Name attrs=displayName | lookup tSessions local=true session_id OUTPUTNEW login_username,login_domain,login_host | fields *"

In testing "dn=Object_Name" should actually be "dn=$Object_Name$". How can have changes made to the app?

External search command 'ldapfetch' returned error code 1. First 1000 (of 2565) bytes of script output: "Access_Mask,mv_Access_Mask,Accesses,mv_Accesses,Account_Domain,mv_Account_Domain,Account_Name,mv_Account_Name,Caller_Domain,__mv_Caller_Domain,C

0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Known issue. Wait for Windows infrastructure 1.0.1.1, upgrade to 6.0 universal forwarder, then install Windows infrastructure.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

Issue is fixed in Windows Infra v1.0.2. Will not be fixing this issue in AD app.

jdunlea
Contributor

Does this still stand for the current version of the SA-ldapsearch?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Known issue. Wait for Windows infrastructure 1.0.1.1, upgrade to 6.0 universal forwarder, then install Windows infrastructure.

skylasam_splunk
Splunk Employee
Splunk Employee

Thanks for reporting this issue. I've logged an internal issue and will schedule for fix in next version.

LintuMathews
Explorer

Did you guys release a Version that fixes the issue ?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...