All Apps and Add-ons

Getting various errors in Splunk App for Active Directory

erstexas
Path Finder

I have followed all the steps that I sould find on installing this. I am actually getting events and most of the screens populate accurately. However, whenever I click on any of the Security > Audits or Security > Reports pages I get the following errors at the top of the screen:

Compilation failed in require at /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/bin/ldapsearch.pl line 3.

Can't locate Log/Log4perl.pm in @INC (@INC contains: /usr/lib/perl5/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/5.10.0 /usr/lib/perl5/site_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.10.0 /usr/lib/perl5/vendor_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.10.0 /usr/lib/perl5/vendor_perl .) at ActiveDirectory.pm line 18.

BEGIN failed--compilation aborted at ActiveDirectory.pm line 18.

BEGIN failed--compilation aborted at /opt/splunk/etc/apps/Splunk_for_ActiveDirectory/bin/ldapsearch.pl line 3.

Error in 'script': Getinfo probe failed for external search command 'ldapsearch'

Any assistance? The other pages load just fine and everything else seems to work. I read in another thread about a required list of Perl modules and I haven't seem this list yet. I may be missing a module?

0 Karma
1 Solution

MarioM
Motivator

as per the app README.txt:

Configuring Perl
----------------
The ldapsearch command used throughout to obtain LDAP information uses Perl in order to be cross-platform.  You must
install Perl 5.10 (or later) and a number of modules.  perl is normally installed by default on Linux systems.  ActiveState 
(http://www.activestate.com/) provides a free community-supported version of perl.

In addition, you will need to install a number of modules.  If you do not have all required modules installed, then the
ldapsearch will generally return error code 2.  The list is as follows:

    Config::IniFiles
    Log::Dispatch::File
    Log::Log4perl
    Net::DNS
    Net::LDAP
    Text::CSV
    Time::Duration
    URI::Escape

To install a module in Windows, use:

    ppm install <module-name>

To install a module in Linux, use:

    perl -MCPAN -e "install <module-name>"

Note that dependent modules will need to be installed in both cases. There are reports that Config::IniFiles needs to have
Module::Build installed first. Ensure that all modules install successfully.  On Linux, you must be root to install modules.  
If you are running a platform other than Linux or Windows, consult your CPAN documentation on installing modules.  All the 
modules listed are pure Perl modules, so they should work cross-platform.

NOTE: At this time, running the perl commands on Windows x64 is not possible due to the following bug:

    https://rt.cpan.org/Public/Bug/Display.html?id=59790

The bug report has a diff for the broken files (which are standard files for Windows platforms and distributed with the
perl distribution).  At this time, there is no timeline for when this fix will be implemented by the author.  As a result,
we cannot recommend nor support the use of this application on Windows.

Operational logs regarding the ldapsearch command are logged in the perl.log file and available in the internal indices.

View solution in original post

MarioM
Motivator

as per the app README.txt:

Configuring Perl
----------------
The ldapsearch command used throughout to obtain LDAP information uses Perl in order to be cross-platform.  You must
install Perl 5.10 (or later) and a number of modules.  perl is normally installed by default on Linux systems.  ActiveState 
(http://www.activestate.com/) provides a free community-supported version of perl.

In addition, you will need to install a number of modules.  If you do not have all required modules installed, then the
ldapsearch will generally return error code 2.  The list is as follows:

    Config::IniFiles
    Log::Dispatch::File
    Log::Log4perl
    Net::DNS
    Net::LDAP
    Text::CSV
    Time::Duration
    URI::Escape

To install a module in Windows, use:

    ppm install <module-name>

To install a module in Linux, use:

    perl -MCPAN -e "install <module-name>"

Note that dependent modules will need to be installed in both cases. There are reports that Config::IniFiles needs to have
Module::Build installed first. Ensure that all modules install successfully.  On Linux, you must be root to install modules.  
If you are running a platform other than Linux or Windows, consult your CPAN documentation on installing modules.  All the 
modules listed are pure Perl modules, so they should work cross-platform.

NOTE: At this time, running the perl commands on Windows x64 is not possible due to the following bug:

    https://rt.cpan.org/Public/Bug/Display.html?id=59790

The bug report has a diff for the broken files (which are standard files for Windows platforms and distributed with the
perl distribution).  At this time, there is no timeline for when this fix will be implemented by the author.  As a result,
we cannot recommend nor support the use of this application on Windows.

Operational logs regarding the ldapsearch command are logged in the perl.log file and available in the internal indices.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...