All Apps and Add-ons

SA-ldapsearch in Search Activity App

ejread
Explorer

I have a working connection to AD using the Splunk Supporting Add-on for Active Directory 2.1.4. I'm able to use the |ldapsearch command in most apps, as it is shared globally with [] export=system. It works fine in the Windows infra app, nix app, etc., but not the "Search Activity" app. I get the error -

Search Factory: Unknown search command 'ldapsearch'

Permissions on the ldapsearch command are shared globally. Not sure what else might be preventing the app from using this command?

1 Solution

leonphelps_s
Path Finder

Hello.

That error is actually caused by the Search Activity apps default.meta and local.meta settings.

I noticed that they have import values set.

default.meta:import = search,search_activity
local.meta:import = search, search_activity

It has been my experience that when you expliciltly import knowledge objects from apps.. anything NOT imported is not avaialble for use.

I've commented out the two import lines and then the search command completes correctly. You could probably just add the sa-ldapsearch app to the import line that would also fix it.

View solution in original post

leonphelps_s
Path Finder

Hello.

That error is actually caused by the Search Activity apps default.meta and local.meta settings.

I noticed that they have import values set.

default.meta:import = search,search_activity
local.meta:import = search, search_activity

It has been my experience that when you expliciltly import knowledge objects from apps.. anything NOT imported is not avaialble for use.

I've commented out the two import lines and then the search command completes correctly. You could probably just add the sa-ldapsearch app to the import line that would also fix it.

View solution in original post

David
Splunk Employee
Splunk Employee

Woo! Will get this fixed in the next version.

(FWIW, I added the import limitations in response to a bug report where another app was overriding one of my macros -- my fix will be to set them to be search, search_activity, ldapsearch, sa-ldapsearch, SA-ldapsearch)

Excellent find!

0 Karma

ejread
Explorer

Yes - this was a meta issue. I had to tweak the import settings. Thanks!

0 Karma

rpquinlan
Path Finder

"You could probably just add the sa-ldapsearch app to the import line that would also fix it. "

Commenting out those 2 lines worked for me. adding the app to the import line in the local.meta did not, however.. Until I realized it was case sensitive - "SA-ldapsearch" 😉

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!