After running the following query:
| ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(objectclass=group)" attrs="cn,description,primaryGroupToken"
| eval joiner=mvappend(dn,primaryGroupToken)
| rename dn as groupDN,cn as groupName,primaryGroupToken as primaryGroupID
| table groupDN,groupName,primaryGroupID,joiner
| mvexpand joiner
| join type=inner joiner
[ ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(sAMAccountName=*)" attrs="memberOf,primaryGroupID"
| eval joiner=mvappend(memberOf,primaryGroupID)
| table joiner
| mvexpand joiner]
| dedup groupDN
| table groupDN,groupName,primaryGroupID
| sort primaryGroupID
I receive the following error messages with no results found:
External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "
[drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "
[subsearch]: [drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
Can't seem to figure out how to fix this error message. Thanks in advance for your help.
Hi ,
Please check your ldap.conf . it must have stanza of mydomain in your case.
For further details please read the following link.
Does the [credential:SA-ldapsearch:default:] stanza from the passwords.conf file have to match in both S.H and Indexer ?
I am also getting this same error,
External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""C:\Program Files\Splunk\var\run\searchpeers\my-search-head-15318\apps\SA-ldapsearch\bin\packages\splunklib\client.py"", line 1653 : u'ldap'" "
@damode, please post a new question for help with your problem.
Hi there @jhampton3rd
Don't use wildcards on domain
nor basedn
parameter.
The first error message seems key: "Cannot find the configuration stanza for domain=mydomain in ldap.conf". Have you checked your ldap.conf file?