topic Re: Splunk Users not visible in Splunk Enterprise

Splunk Users not visible

uagraw01 — Tue, 17 Dec 2024 07:06:53 GMT

Hello Splunkers!!

I have reassigned all the knowledge objects of 5 users to admin user. After that those users are not visible in user list when I am logging with "Admin User". Please help to identify the root cause and to fix this scenario.

Thanks in advance.

Re: Splunk Users not visible

PickleRick — Tue, 17 Dec 2024 07:16:42 GMT

This one?

https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-upgrade-to-9-1-0-1-all-users-disappeared/m-p/650560/highlight/true#M16825

Re: Splunk Users not visible

uagraw01 — Tue, 17 Dec 2024 07:24:25 GMT

Hi @PickleRick , I am facing the similar issue.

Exactly I need to do ? shall I change 'grandableRoles' =admin in autoritize.conf file ?

Re: Splunk Users not visible

PickleRick — Tue, 17 Dec 2024 07:44:47 GMT

As far as I remember (that was some time ago) it happened when users' roles allowed them to grant roles but had no list of grantable roles specified whatsoever. So you have to make sure that there is at least one role listed as grantablRoles for those users.

Re: Splunk Users not visible

uagraw01 — Tue, 17 Dec 2024 08:21:35 GMT

@PickleRick As per the link you shared at first place. There mentioned that remove 'grandableRoles' =admin from the admin user from authorize.conf file. Is that workaround will work or shall I try ?

Re: Splunk Users not visible

PickleRick — Tue, 17 Dec 2024 11:19:53 GMT

No. In case of this particular bug it was the other way around. Don't remove grantableRoles. Add it if you don't have it. But that was my issue. Yours can be a different one.

Re: Splunk Users not visible

uagraw01 — Wed, 18 Dec 2024 08:09:12 GMT

Hi @PickleRick, Do you any clue for fix with any other possible way workaround ?

Re: Splunk Users not visible

PickleRick — Wed, 18 Dec 2024 08:20:01 GMT

Nope. That was the issue that I had. If yours is caused by something else - you might need to raise a support ticket.