Getting Data In

ldapsearch Error under user audit "Splunk for Windows Server Active Directory App"

Eric
Explorer

Need to some help getting my install of "Splunk for Windows Server Active Directory" app working. when I run the "User login Failures" search and click on a user that has a failed logon attempt I get these errors...

  • "Lookup table 'HostInfo' is empty"
  • "No Matching fields exist"
  • "Error in 'script': Getinfo probe failed for external search command 'ldapsearch'"

The last error is in Red.

Ideas?

Regards,
Eric

Tags (3)

splunkn
Communicator

I'm having a similar isuse but the error only occurs when I try to run any of the Security > Audit > Reports.

I receive the error in red across the top:

Error in 'script': Getinfo probe failed for external search command 'ldapsearch'

Any suggestions are apprecaited.

0 Karma

splunkn
Communicator

I'm running this on Windows, so I think I answered my own question. Hopefully this can help someone else who is having the same issues.

0 Karma

splunkn
Communicator

Current known issues
The LDAP search commands (that install on the central Splunk App for
Active Directory instance) do not work on Windows operating systems,
owing to platform compatibility issues. As a workaround, build your central
Splunk instance around the Linux platform (MSAD-73).
·
The LDAP search commands do not work for sub-domains in an AD forest
(MSAD-105).
·
Older versions of the universal forwarder might not correctly get some
Windows events. To fix this issue, upgrade your forwarders to the latest
version. (SPL-51312)
·
52

0 Karma

itfpmhtcom
Engager

Running into the same problem here; though I'm still at the initial error - I'll try configuring Perl, but would expect to run into the second issue as well. My install is running on Debian Squeeze.

0 Karma

Eric
Explorer

Moved my splunk install to *nix and still cant get this thing to work. 😞

0 Karma

Eric
Explorer

Okay so I have moved a little further with this issue.. I did not have Perl configured all the way, but now I get error 255 when Perl tries to run.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...