All Apps and Add-ons

Unknown search command 'ldaptestconnection' when configuring Splunk Supporting Add-on for Active Directory

rjbonilla
New Member

Configuring the Splunk Support Addon for AD but keep getting this error when testing the connection

Search
| ldaptestconnection domain="test.lab"
Result
distinguishedName: DC=test,DC=lab
Error
[Splunk.test.lab] Search Factory: Unknown search command 'ldaptestconnection'.

0 Karma

pmakwana_splunk
Splunk Employee
Splunk Employee

This might happen incase of Searchhead and Indexer clustering. By default the ldap custom commands are set to run on local machine (or SH) but incase of distributed architecture the queries are running on indexers and Indexers might not have SA-ldapsearch app installed and hence these commands would not run.

Please try the below on your SH and then restart the splunk.
1) Create the local folder under SA-ldapsearch
2) Copy the commands.conf from default folder to local folder
3) Edit the commands.conf of local folder and change the parameter from "local=false" to "local=true"
4) Restart the SH

If you are using the SH deployer then you need to follow the same steps on Deployer and then push the apps on SH.

Please refer the below doc for the reference
https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/Workaroundfordefaultconfigstanzaerror...

Let me know if you face any issues.

Thanks,
Pratik

lloydknight
Builder

Hello rjbonilla

Have tried checking the splunkd.log for errors on the ldap authentication?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...