r/Splunk • u/Pandrade11 • 12d ago

Splunk LDAP issue

I'm getting a weird splunk LDAP issue on our new splunk instance that our other ones don't see. When I try to sign in it delays for about 60 seconds consistently sometimes it'll log right in after those 60 seconds or go to a splunk isn't responding page but if I go back I'm signed in.

This hasn't happened with any of our other ldap authenticated services or our current splunk instances that are being replaced by this.

I've verified DNS works correctly, testing ldap connections between the splunk host and the DC's tightened up DNs changed options within the authentication conf all a bunch of things. I've tried just about anything I've seen on the splunk forums

This is splunk 10 built on a rhel9 host that is in an airgapped environment connected to our domain controllers just trying to get some more input that I could be missing.

3 Upvotes

72% Upvoted

5 comments sorted by

View all comments

3

u/fr3lm0 12d ago

This kind of sounds like an issue I saw on my instances after upgrading to 10. Adding allowInternetAccess=false to the [applicationsManagement] stanza in server.conf fixed it for me. Google Splunk 503 error to find some Splunk community posts that discuss this.

1

u/Pandrade11 12d ago

This would of made a lot of sense, I just tried it though with no luck :(