topic Re: How do you actually delete a user in the Splunk web UI? in Security

How do you actually delete a user in the Splunk web UI?

gsypsomos — Thu, 16 Nov 2017 17:05:54 GMT

When I go to Users in the Splunk web UI, there is no option/action available next to the user accounts. I have tried with the admin account as well as with power user accounts. Using Splunk 6.5.2.

Re: How do you actually delete a user in the Splunk web UI?

niketn — Thu, 16 Nov 2017 19:14:02 GMT

@gsypsomos, is this for Splunk built in Access Control?

With Admin role you should be able to delete Users. However, if you are not able to can you try one of the following:

1) Try with a user with can_delete role.
2) Try DELETE user via REST API to see if you have access to delete or not
http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTaccess#authentication.2Fusers.2F.7Bname.7D

Re: How do you actually delete a user in the Splunk web UI?

somesoni2 — Thu, 16 Nov 2017 20:05:54 GMT

If you're using LDAP authentication OR any other non-native method for authenticating/adding users in your environment, you'll not be able to delete User from Splunk Web UI. You need to remove users from those source systems. E.g. If you're using LDAP authentication, to remove a user from Splunk, remove it from the splunk LDAP group is associated with.

Re: How do you actually delete a user in the Splunk web UI?

MuS — Thu, 16 Nov 2017 20:06:35 GMT

Two things to add:

you cannot delete a user if you are logged on as this user
you cannot delete a LDAP user

cheers, MuS

Re: How do you actually delete a user in the Splunk web UI?

gsypsomos — Fri, 17 Nov 2017 14:58:07 GMT

This was the solution. We are using LDAP, so I logged on to a Windows server and managed active directory users and computers, performed a Find for the user account, and then looked at the group memberships that the user belonged to. I removed their memberships in the Splunk management AD group, and their account disappeared from Splunk.

Thank you, somesoni2.

Re: How do you actually delete a user in the Splunk web UI?

somesoni2 — Fri, 17 Nov 2017 15:43:55 GMT

I've converted my comment to an answer so that you can mark your question resolved by accepting the same.