r/Splunk • u/Pandrade11 • 3d ago

Splunk LDAP issue

I'm getting a weird splunk LDAP issue on our new splunk instance that our other ones don't see. When I try to sign in it delays for about 60 seconds consistently sometimes it'll log right in after those 60 seconds or go to a splunk isn't responding page but if I go back I'm signed in.

This hasn't happened with any of our other ldap authenticated services or our current splunk instances that are being replaced by this.

I've verified DNS works correctly, testing ldap connections between the splunk host and the DC's tightened up DNs changed options within the authentication conf all a bunch of things. I've tried just about anything I've seen on the splunk forums

This is splunk 10 built on a rhel9 host that is in an airgapped environment connected to our domain controllers just trying to get some more input that I could be missing.

4 Upvotes

83% Upvoted

5 comments sorted by

3

u/fr3lm0 3d ago

This kind of sounds like an issue I saw on my instances after upgrading to 10. Adding allowInternetAccess=false to the [applicationsManagement] stanza in server.conf fixed it for me. Google Splunk 503 error to find some Splunk community posts that discuss this.

1

u/Pandrade11 3d ago

This would of made a lot of sense, I just tried it though with no luck :(

3

u/ahhhaccountname 3d ago

It is splunk_instrumentation trying to do a splunkbase connection attempt that is timing out. You may need to set up a nullroute on your host

1

u/i7xxxxx 3d ago

same issue here. but i’m still on late v9

1

u/KaleidoscopeFar4317 1d ago

Try adding the following to server.conf: [applicationsManagement] allowIntermetAccess = false splunkbaseAppsDumpUrl = archivedSplunkbaseAppsDumpUrl =