Splunk authentication scripts – performance issue

As mentioned before, I am playing around with Splunk's authentication scripts with Centrify DC.


While playing I ran into a performance issue with the AuthenticationScripts implementation of getUsers.


According to the documentation the output is:


--status=success|fail 
--userInfo=<userId>;<username>;<realname>;<roles>
--userInfo=<userId>;<username>;<realname>;<roles>
...

During debugging and looking in the logs of splunk I noticed that for each user a seperate getUserInfo is initiated per user... this is awkward, because the getUsers contains the same information per user as the getUserInfo.


Just as my previous post on Splunk, I raised this issue via SMT Ware with Splunk.