topic Re: User has left the company, now getting "Could not find user:" errors in Security

User has left the company, now getting "Could not find user:" errors

mikelanghorst — Mon, 28 Sep 2020 11:25:50 GMT

I've had a few users leave the company now that have had saved searches. Removing the $splunk_home/etc/users/ directory doesn't resolve the errors.

If I search for files that contain the login name, I find the following example entry for "tuser"q:
etc/apps/search/local/viewstates.conf:
[viewstates/flashtimeline%3Agu5s5mv8]
owner = tuser
version = 4.2.3
export = system

Is it safe to remove these entries? Is there a better way to remove terminated users?

Re: User has left the company, now getting "Could not find user:" errors

mikelanghorst — Tue, 21 Feb 2012 23:33:04 GMT

Removing those entries in viewstates.conf doesn't resolve the error either.

Re: User has left the company, now getting "Could not find user:" errors

Brian_Osburn — Wed, 22 Feb 2012 08:07:39 GMT

Make sure the users not in any meta files either. If you're on a linux machine I'd do the following:

grep -r "username" $SPLUNK_HOME

That'll find all instances of the user name in any configuration files.