topic Re: Indexer Cluster user="" had no roles in Splunk Enterprise

Indexer Cluster user="" had no roles

NoSpaces — Mon, 07 Oct 2024 08:18:53 GMT

Hello to everyone!
Today I noticed strange messages in the daily warn and errors report:

10-04-2024 16:55:01.935 +0300 WARN UserManagerPro [5280 indexerPipe_0] - Unable to get roles for user= because: Could not get info for non-existent user="" 10-04-2024 16:55:01.935 +0300 ERROR UserManagerPro [5280 indexerPipe_0] - user="" had no roles

I checked that this couple first appeared 5 days ago, but this fact can't help me because I don't remember what I changed in the exact day.
I also tried to find some helpful "nearby" events that can help me to understand the root case, but didn't observe anything interesting.
Which ways do I have to investigate this case?
Maybe I can "rise" log policy to DEBUG lvl? If I can, what should I change and where?

Little more information:
I have searchhead cluster with LDAP authorization
And also indexer cluster only with local users

Re: Indexer Cluster user="" had no roles

NoSpaces — Tue, 08 Oct 2024 09:37:28 GMT

Re: Indexer Cluster user="" had no roles

NoSpaces — Thu, 17 Oct 2024 07:47:13 GMT

Re: Indexer Cluster user="" had no roles

NoSpaces — Thu, 28 Nov 2024 10:12:05 GMT

Up

A week ago, I tried to enable DEBUG log to find the root case
But found only the similar events without anything helpful to find the root case

Re: Indexer Cluster user="" had no roles

NoSpaces — Wed, 18 Dec 2024 08:26:35 GMT

Re: Indexer Cluster user="" had no roles

PickleRick — Wed, 18 Dec 2024 08:47:08 GMT

Please stop UP-ing the thread. You haven't found a similar issue in old threads, noone seems to be able to help you here right now. It's time to engage support. Posting "UP" once a week only clutters the forum.

Thanks for understanding.

Re: Indexer Cluster user="" had no roles

NoSpaces — Wed, 18 Dec 2024 09:00:24 GMT

Sorry for had being annoying, I'm stopping this behavior.

Re: Indexer Cluster user="" had no roles

isoutamo — Wed, 18 Dec 2024 18:22:30 GMT

Have you check this https://community.splunk.com/t5/Security/ERROR-UserManagerPro-user-quot-system-quot-had-no-roles/m-p/309029 ?

Re: Indexer Cluster user="" had no roles

NoSpaces — Thu, 19 Dec 2024 15:12:02 GMT

@isoutamo, Thank you for your attention to my problem.
I saw this post, and I also saw the resolution—create the user 'system'.
But my case is a little bit different because errors have no information about the user that is absent.
Only quotes without anything.

Re: Indexer Cluster user="" had no roles

isoutamo — Thu, 19 Dec 2024 18:12:00 GMT

Only thing what comes my mind is that you should try to find some matches from other logs including sh side, which process or query has initiated this query on indexer side and found more information over there.
Another option is create a support case to splunk.