https://community.splunk.com/t5/Security/Splunk-searches-from-deleted-users/m-p/93867#M3112 <P>We can see in our splunkd.log that is showing the following errors:</P> <P>UserManagerPro - Failed to get LDAP user="xxx" from any configured servers<BR /> AuthenticationManagerLDAP - user="xxx" has matching LDAP groups with strategy="yyyy", but none are mapped to Splunk roles</P> <P>We also get some error messages with 'user="splunk"', but have no user splunk. They are not the same as those run by splunk-system-user.</P> <P>These users were removed, and should not be running searches. Yet these messages are consistently being reported. We would like to know what searches they apply to, so we can disable the searches, or move them to another user. But the message does not say what searches are running, nor give us any information to go on. Any ideas?</P> <P>Richard Thomsen</P> Wed, 17 Oct 2012 21:19:25 GMT rgtsplunk 2012-10-17T21:19:25Z https://community.splunk.com/t5/Security/Splunk-searches-from-deleted-users/m-p/93867#M3112 <P>We can see in our splunkd.log that is showing the following errors:</P> <P>UserManagerPro - Failed to get LDAP user="xxx" from any configured servers<BR /> AuthenticationManagerLDAP - user="xxx" has matching LDAP groups with strategy="yyyy", but none are mapped to Splunk roles</P> <P>We also get some error messages with 'user="splunk"', but have no user splunk. They are not the same as those run by splunk-system-user.</P> <P>These users were removed, and should not be running searches. Yet these messages are consistently being reported. We would like to know what searches they apply to, so we can disable the searches, or move them to another user. But the message does not say what searches are running, nor give us any information to go on. Any ideas?</P> <P>Richard Thomsen</P> Wed, 17 Oct 2012 21:19:25 GMT https://community.splunk.com/t5/Security/Splunk-searches-from-deleted-users/m-p/93867#M3112 rgtsplunk 2012-10-17T21:19:25Z https://community.splunk.com/t5/Security/Splunk-searches-from-deleted-users/m-p/93868#M3113 <P>you're most likely seeing saved searches created by these users that are run on a schedule. to see the owners of saved searches, you can look in Manager &gt; Searches and reports. </P> <P>once there, you can use the search box on the right to look for those usernames, or filter by app. </P> <P>to change the owner of a search defined in $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf, edit the ownership and permissions defined in etc/apps/search/metadata/local.meta. you'll need to substitute the app name of any app you're working on for 'search'</P> <P>you will have to restart splunk to see the change. </P> Fri, 21 Dec 2012 21:55:41 GMT https://community.splunk.com/t5/Security/Splunk-searches-from-deleted-users/m-p/93868#M3113 piebob 2012-12-21T21:55:41Z