topic Re: How can I completely delete a user in Splunk ES? in Splunk Search

How can I completely delete a user in Splunk ES?

fahimeh — Sun, 01 Sep 2024 10:30:08 GMT

Hello,

As an admin, I deleted a user in Splunk Web, but when I try to add a user during an investigation, I still see the deleted user in the list. Why is this happening?

Is there a conflict between deleting users in Splunk Enterprise and Splunk ES?

Re: How can I completely delete a user in Splunk ES?

vr2312 — Mon, 02 Sep 2024 01:38:31 GMT

The names of the investigators are populated in the KV Store, user_realnames, Here are steps that needs to be taken for removing the old investigators.

Navigate to the app "Splunk App for Lookup File Editing" for editing the KV Store.
On the Lookups page, find the “user_realnames_lookup” file and edit it
Delete the users who are not part of the organization currently. To Delete, select any cell in the table and right click you will see options to delete the selected rows if needed.
Ensure that the profiles no longer appear in the investigators section after the lookup update.

Re: How can I completely delete a user in Splunk ES?

gcusello — Mon, 02 Sep 2024 07:53:43 GMT

Hi @fahimeh ,

ES hasn't its own authentication method, it uses users from Splunk Enterprise, it only has its own roles.

If you delete an user in Splunk Enterprise its isn't possible for that user access the system, but probably the investigation and action from tha user continue to remain in the system, even if if you search an object created by that user you find an orphaned object.

Ciao.

Giuseppe

Re: How can I completely delete a user in Splunk ES?

fahimeh — Sat, 07 Sep 2024 09:41:41 GMT

hi @vr2312

Thank you for your response; it was completely correct.