Splunk® Supporting Add-on for Active Directory

Deploy and Use the Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Supporting Add-on for Active Directory. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

About the Splunk Supporting Add-on for Active Directory

App Version 2.1.7
Vendor products Windows Server Active Directory (LDAP) services

The Splunk Supporting Add-on for Active Directory lets you collect Active Directory schema and other information from Active Directory as events and filter on those events.

How does it work?

The Splunk Supporting Add-on for Active Directory has the following uses:

  • To generate events based on the contents of an LDAP server such as Active Directory.
  • To augment events with information from an LDAP server such as Active Directory.
  • To perform Active Directory group expansions.

In order to use the Splunk Supporting Add-on for Active Directory, you must configure it. Read "Install the Splunk Supporting Add-on for Active Directory" to learn how.

How do I get it?

You can download the add-on from Splunk Apps.

How do I upgrade from a previous version?

To upgrade from a previous version of the Splunk Supporting Add-on for Active Directory, install this version directly on top of the previous version. You can use Splunk Web or the CLI, or you can upgrade it from the command line.

Note: If you have a previous version installed, on upgrade, the app maintains ldap.conf from the previous installation. When you add any new domains to search, the add-on stores the credentials securely, instead of in the ldap.conf file. If you edit an existing domain entry using the new Configuration page, it also stores those credentials securely. Existing entries that you do not edit continue to have their credentials stored locally.

What search commands come with it?

There are four search commands and one test command in this add-on. Once configured, the add-on uses the configuration for all the commands. You can learn more about the commands in the following topics:

Where can I ask questions and get help?

You can visit Splunk Answers to discuss and get help on the Splunk Supporting Add-on for Active Directory. See "How to get support and find out more information about Splunk Enterprise" for additional support options.

Last modified on 11 October, 2018
  NEXT
How this add-on fits into the Splunk picture

This documentation applies to the following versions of Splunk® Supporting Add-on for Active Directory: 2.1.7


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters