topic Why am I getting "WARN AuthorizationManager - Unknown role" errors in splunkd.log after deleting the VMware and Windows Infrastructure apps? in Getting Data In

Why am I getting "WARN AuthorizationManager - Unknown role" errors in splunkd.log after deleting the VMware and Windows Infrastructure apps?

bravon — Mon, 28 Sep 2020 19:04:59 GMT

After removing the Windows Infrastructure and VMWare applications, we get the following errors in splunkd.log:

WARN AuthorizationManager - Unknown role 'winfra-admin'
WARN AuthorizationManager - Unknown role 'splunk_vmware_admin'

I can't seem to find where the old (deleted/removed) roles are referenced - can someone point me in the right direction?

Re: Why am I getting "WARN AuthorizationManager - Unknown role" errors in splunkd.log after deleting the VMware and Windows Infrastructure apps?

bravon — Wed, 04 Mar 2015 10:59:44 GMT

After reading http://answers.splunk.com/answers/205496/how-to-troubleshoot-unknown-role-warnings-for-ess.html i found a reference in etc\system\local\authorize.conf

Re: Why am I getting "WARN AuthorizationManager - Unknown role" errors in splunkd.log after deleting the VMware and Windows Infrastructure apps?

azurite257 — Tue, 29 Sep 2020 09:50:40 GMT

It's not the authorized.conf. ess_user, ess_admin, ess_analysts would have been additional roles associated with admin account or other users defined local to the splunk (i.e. if you are using LDAP, then only system accounts that should be defined would have been admin).

Look at the $SPLUNK_HOME/etc/passwd. remove the roles associated that is no-longer existing on that splunk instance. That should get rid of the errors in the log.

:admin:$$::Administrator:admin;ess_admin;ess_analyst:changeme@example.com::

In above example, remove the entries ';ess_admin;ess_analyst' and save. Restart splunk, and error will be gone.