This question was superseded by the excellent SA-ldapsearch application, so I'll mark it as answered. Here's the basic gist of how we're dumping our AD asset lookup, hopefully somebody finds it useful: | ldapsearch domain=CONTOSO search="(objectClass=computer)" | eval priority=case(match(memberOf, "(?i)production"), "critical", match(memberOf, "(?i)disaster_recovery"), "high", match(memberOf, "(?i)test"), "medium", 1=1, "low") | eval category="contoso" | eval cn=lower(cn) | eval dns=toString(cn) + ".contoso.com" | eval bunit=case(match(distinguishedName, "(?i)ou=mgmt"), "Management", match(distinguishedName, "(?i)ou=sales"), "Sales", match(distinguishedName, "(?i)ou=it"), "Information Technology", match(distinguishedName, "(?i)ou=legal"), "Legal", 1=1, "Contoso") | eval lat=case(match(memberOf, match(memberOf, "(?i)disaster_recovery"), 21.30694, 1=1, 38.8895) | eval long=case(match(memberOf, "(?i)disaster_recovery"), -157.85833, 1=1, -77.0352) | eval city=case(match(memberOf, "(?i)disaster_recovery"), "Honolulu, HI", 1=1, "Washington, DC") | eval country="USA" | eval category = category + "|" | eval category = category + case(match(operatingSystem, "(?i)windows\sserver"), "server|windows", match(operatingSystem, "(?i)windows"), "workstation|windows", match(operatingSystem, "(?i)RHEL") OR match(operatingSystem, "(?i)RedHat") OR match(operatingSystem, "(?i)CentOS") OR match(operatingSystem, "(?i)RedHat") OR match(operatingSystem, "(?i)unknown"),"server|linux", match(operatingSystem, "(?i)SunOS"), "server|solaris", 1=1, "device|unknown") | eval os=trim(lower(operatingSystem)) | eval os=trim(replace(os, "windows", "")) | eval os=trim(replace(os, "server", "")) | eval osver=trim(lower(operatingSystemServicePack)) | eval ossp=trim(lower(operatingSystemVersion)) | eval category=if(isNotNull(os) AND os!="unknown", toString(category) + "|" + toString(os), category) | eval category=if(isNotNull(osver) AND os!="unknown", toString(category) + "|" + toString(osver), category) | eval category=if(isNotNull(ossp) AND os!="unknown", toString(category) + "|" + toString(ossp), category) | eval category=if(match(distinguishedName, "(?i)ou=domain\scontroller"), toString(category) + "|domain_controller", category) | eval category=if(match(distinguishedName, "(?i)ou=laptops"), toString(category) + "|laptop", category) | eval category=if(match(distinguishedName, "(?i)ou=desktop"), toString(category) + "|desktop", category) | eval category=if(match(distinguishedName, "(?i)ou=linux") AND match(distinguishedName, "(?i)splunk"), toString(category) + "|splunk", category) | eval category=if(match(distinguishedName, "(?i)ou=linux") AND match(distinguishedName, "(?i)log"), toString(category) + "|log", category) | eval category=if(match(memberOf, "(?i)production"), toString(category) + "|production", category) | eval category=if(match(memberOf, "(?i)test"), toString(category) + "|test", category) | eval category=if(match(memberOf, "(?i)disaster_recovery"), toString(category) + "|disaster_recovery", category) | eval category=if(match(servicePrincipalName, "(?i)MSClusterVirtualServer"), toString(category) + "|cluster_object", category) | eval category=if(strptime(lastLogonTimestamp, "%Y/%m/%d %H:%M:%S %Z")>relative_time(now(),"-30d@d"), toString(category) + "|account_active", category + "|account_inactive")| eval should_update="TRUE" | eval should_timesync="FALSE" | eval requires_av=case(match(operatingSystem, "(?i)windows"), "TRUE", 1=1, "FALSE") | eval is_expected=case(match(category, "(?i)splunk") OR match(category, "(?i)log") OR match(category, "(?i)domain_controller"), "TRUE", 1=1, "FALSE") | ldapfetch dn=managedBy attrs=mail | table ip,mac,cn,dns,mail,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av,description,location,patchgroup,operatingSystem,operatingSystemServicePack,operatingSystemVersion, lastLogonTimestamp | rename cn AS nt_host, mail AS owner, operatingSystem AS os, location AS ad_location, description AS ad_description, operatingSystemServicePack AS ad_operatingSystemServicePack, lastLogonTimestamp AS ad_lastLogonTimestamp | outputlookup ad_assets ... View more

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed. ... View more

Can you try logging to a TCP input? I imagine you are are hitting MTU for those UDP log packets. In our environment, we log to syslog-ng and then index those logs, taking the host off the segment on the path. The results are more predictable than using a Splunk input. Hope this helps. ... View more

We are running all of our Splunk servers on Linux, but we use IIS on Windows as a reverse proxy to Splunk. We've figured out a hackish but functional way to give users from another Active Directory forest SSO access to dashboards that I think will give you what you're asking for. What you need: A Windows server running IIS 7+ The free Microsoft Application Request Routing (ARR) extension - available for download from: http://www.iis.net/download/applicationrequestrouting The free Microsoft URL Rewrite extension - available for download from: http://www.iis.net/download/URLRewrite The free Helicon ISAPI_Rewrite module – available for download from: http://www.helicontech.com/download-isapi_rewrite3.htm A Splunk search head configured for LDAP and SSO. Set remoteUser = REMOTE-USER instead of REMOTE_USER. Here's how we set up the proxy, best as I can remember: Install ARR v2.1 using the default options. Install URL Rewrite v2.0 using the default options. Install the Helicon ISAPI_Rewrite3 Module to IIS. The free version is sufficent because we will be using ARR to work around the free version’s RewriteProxy limitations… From the Application Request Routing Cache feature view, click on the Server Proxy action and Enable proxy. Create a new IIS web site for the Splunk proxy address (ex – splunk.xyz.com). Bind an SSL certificate to the web site at this time. On the newly created website’s feature view, click on URL Rewrite and then the Add Rule(s) action. Create a rule based on the Reverse Proxy template which points to your Splunk search head. Enable SSL Offloading. Edit the rule such that a Condition input of {HTTP_HOST} matches the pattern (splunk\.xyz\.com). By chaining such Reverse Proxy rules, you can specify multiple Splunk environments if you need to (splunkdev\.xyz\.com)… Make the first rule {HTTPS} matches ^OFF$ if you want to redirect all web traffic to SSL. Edit the Helicon configuration as below: RewriteHeader REMOTE_USER: .* $1 RewriteMap user int:tolower RewriteCond %{REMOTE_USER} .* \\([^\\]+) RewriteHeader Remote-User: .* ${user:%1} RewriteBase / RewriteHeader Remote-User: ^(abcuser1|abcuser2|abcuser3) abc_developer RewriteHeader Remote-User: ^(abcuser5|abcuser5) abc_admin RewriteBase / The above example converts REMOTE_USER to lowercase, strips out Active Directory domain information, and populates a new Remote-User variable with the result. Then, if the user matches the regex in any of the next sections, the Remote-User variable will be populated with the specified abc_developer or abc_admin user name. This rewritten user name can match an account in the configured AD LDAP repository or can be a shared Splunk local user account. That’s it! ... View more