topic Re: Splunk "strategy=" error on startup in Monitoring Splunk

Splunk "strategy=" error on startup

OldManEd — Mon, 15 Sep 2014 16:33:42 GMT

I'm trying to "clean-up" an inherited instance of Splunk before going to release 6.1.3. I've noticed that in the splunkd.log file, when I restart Splunk, I get the following error;

09-15-2014 09:05:41.663 -0700 ERROR AuthenticationManagerLDAP - Could not find user="<UID>" with strategy="SplunkAD"
09-15-2014 09:05:41.664 -0700 ERROR UserManagerPro - Failed to get LDAP user="<UID>" from any configured servers

Does anyone know what's going on here? I've deleted the UID from the "/opt/splunk/etc/users" directory and changed any mention of the UID in "/opt/splunk/etc/apps//metadata/local.meta" to admin.

As always, any help would be greatly appreciated.

Re: Splunk "strategy=" error on startup

martin_mueller — Mon, 15 Sep 2014 16:53:58 GMT

Usually there's some saved/scheduled search still around under that name. Double-check all the metadata to be sure.

Re: Splunk "strategy=" error on startup

OldManEd — Mon, 15 Sep 2014 17:39:50 GMT

I ran a "grep" from /opt/splunk looking at ~everything~ for the UID - nothing. I reviewed the searches and everything else I could think of looking for the UID causing the error - again nothing. As a last resort I selected the "Jobs" tab from the Splunk search window and entered "App=All” and “Owner-All”. I then entered the UID that has been giving me problems and it came back with 2 entries from 2011. I deleted them both and the errors have stopped.

Thanks for everyone's help on this one.