Security

How to load more than 1000 records from LDAP?

daniel_splunk
Splunk Employee
Splunk Employee

How to load more than 1000 records from LDAP?

1 Solution

mwong
Splunk Employee
Splunk Employee

If you want to load more than 1000 users in Splunk manager page, there are 2 parameters to set in Splunk.

authentication.conf
sizelimit =

limits.conf
[ldap]
max_users_to_precache =
as default is 1000, normally you will just see 1000 users in the manager page.

View solution in original post

mwong
Splunk Employee
Splunk Employee

For setting more than 1000 users, the impact will be having more memory usage and slow down login time. It is better to manage with AD groups, filter those groups in authentication.conf file and select a subset of users to login to Splunk so that limited number of AD users will be "precache" in Splunk.

0 Karma

mwong
Splunk Employee
Splunk Employee

If you want to load more than 1000 users in Splunk manager page, there are 2 parameters to set in Splunk.

authentication.conf
sizelimit =

limits.conf
[ldap]
max_users_to_precache =
as default is 1000, normally you will just see 1000 users in the manager page.

ben_leung
Builder

What are the downsides(if any) to setting size limit and max_users_to_precache to a value of 10,000? Will there be memory issues? Will things in the UI be slower to load if you expect more than 1000 users?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...