Hello, Is it possible at all to use event sampling (1:100 or 1:1000) in the new dashboard studio? It works fine using classic dashboarding, but I'm unable to find a way to use it in the new json format, and it's not documented here: Data source options and properties - Splunk Documentation I would have expected something like this to work:     "options": { "query": "mysearch", "sampleRatio": 100 },      Thanks ! ... View more

Hello, We upgraded SA-Ldapsearch from 2.1.4 to 2.2.0 and since the upgrade we are unable to do some LDAP queries using "partial" wildcards. Working: |ldapsearch limit=1 search="(sAMAccountName=Username)" |ldapsearch limit=1 search="(sAMAccountName=*)" Not working: |ldapsearch limit=1 search="(sAMAccountName=User*)" (Note the * after part of the username) It throws the following error: External search command 'ldapsearch' returned error code 1. Script output = "error_message=AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 482 : Initial instance has no attribute 'hasValue' " Extract from the logs: 2019-02-20 13:40:41,490, Level=ERROR, Pid=8136, File=search_command.py, Line=969, AttributeError at "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 482 : Initial instance has no attribute 'hasValue' Traceback: File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\search_command.py", line 593, in _process_protocol_v1 self._execute(ifile, None) File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\generating_command.py", line 196, in _execute self._record_writer.write_records(self.generate()) File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\splunklib\searchcommands\internals.py", line 519, in write_records for record in records: File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\ldapsearch.py", line 105, in generate for entry in entry_generator: File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\extend\standard\PagedSearch.py", line 64, in paged_search_generator None if cookie is True else cookie) File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\core\connection.py", line 779, in search response = self.post_send_search(self.send('searchRequest', request, controls)) File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\base.py", line 303, in send self.connection.request = BaseStrategy.decode_request(message_type, request, controls) File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\strategy\base.py", line 635, in decode_request result = search_request_to_dict(component) File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 520, in search_request_to_dict 'filter': filter_to_string(request['filter']), File "C:\Program Files\Splunk\etc\apps\SA-ldapsearch\bin\packages\ldap3\operation\search.py", line 482, in filter_to_string if substring[component] is not None and substring[component].hasValue(): It was working fine with the 2.1.x version of the App. I opened a case with support (1287612) and will update on results. Regards, ... View more