topic Re: Removing users from a Search Head in Deployment Architecture

Removing users from a Search Head

sgarvin55 — Wed, 04 Jan 2012 22:30:30 GMT

I was looking for the proper way to remove a user(s) from a Search Head. I know that just deleting the directory is not sufficient and may cause errors when you restart Splunk. Especially, if the user had saved or scheduled searches.

Here's a typical error being reported after a user was moved to user.OLD.

ERROR: pid 6750542 terminated with signal 6
Validating databases (splunkd validatedb) failed with code '-1'.

When the user.old was moved back to "user", the error disappeared.

Re: Removing users from a Search Head

rroberts — Thu, 05 Jan 2012 17:25:18 GMT

Why not just use the CLI:

splunk remove user

See:

splunk help remove
Also check out:

http://docs.splunk.com/Documentation/Splunk/4.2.5/Admin/Setupbuilt-inauthentication

Re: Removing users from a Search Head

sgarvin55 — Thu, 05 Jan 2012 22:40:52 GMT

By using the ./splunk remove user username command as you suggested will only remove the user account to login to the GUI. If you go to $SPLUNK_HOME/etc/users the accounts directory still exists.
What I found out is that LDAP is part of the equation and why it was getting a database error. The user will have to be removed from Active Directory first. Then move the users directory to .BAK. Splunk is trying to authenticate the user against LDAP and the directory didn't exist.

Re: Removing users from a Search Head

rafamss — Wed, 14 Oct 2015 13:55:15 GMT

Hi sgarvin55,

I did the follow and this solved my problem.

./splunk remove user [nameuser] -auth user:pass

For improve this, I put a little trick, inserting a "|" after each command. With this, I can delete all users that needs upon a time.

./splunk remove user [user1] |
./splunk remove user [user2] |

All this commands was executed in CLI.