topic Re: Users still showing after being deleted in Splunk Search

Users still showing after being deleted

wpb162 — Mon, 03 Jun 2024 16:47:03 GMT

I am trying to delete users that just use Splunk authentication. I have the admin role. I have tried both the web GUI and the CLI to delete users, but they are still visible after deletion. But something seems to have happened, because, even though the users are still showing up using the list command in the CLI, when I try to delete the user using the remove command, it says the user does not exist.

Is there a config file I need to edit to get the users to stop appearing? This is also a clustered Splunk Enterprise environment, does this mean there are further steps I have to take to delete a user?

Thanks

Re: Users still showing after being deleted

KendallW — Tue, 04 Jun 2024 01:22:39 GMT

Hi @wpb162
It could be that the removal of the users has not propagated to all members of the SHC yet. How many members are in your SHC? How long did you leave it after running the "splunk remove user" command?

Re: Users still showing after being deleted

PickleRick — Tue, 04 Jun 2024 07:55:09 GMT

What are you using for authentication? If you are using external authentication source (like LDAP or SAML) your users will get re-created as soon as they authenticate using that source.

Re: Users still showing after being deleted

wpb162 — Tue, 04 Jun 2024 13:16:42 GMT

Just using the local Splunk authentication (username and password), nothing external.

Re: Users still showing after being deleted

wpb162 — Tue, 04 Jun 2024 13:17:32 GMT

3 members in the cluster, has not updated since I made the change yesterday, even on the instance I made the change on.

Re: Users still showing after being deleted

deepakc — Tue, 04 Jun 2024 16:38:55 GMT

Removing users is a standard splunk admin task, so this is odd!.

If you look at your config, what does this state?

If you run the btool command and check your authentication config?

/opt/splunk/bin/splunk cmd btool authentication list --debug

Re: Users still showing after being deleted

PickleRick — Tue, 04 Jun 2024 16:45:37 GMT

Another thing that comes to mind - local file permissions? (splunk process unable to alter the passwd file)

Re: Users still showing after being deleted

wpb162 — Tue, 04 Jun 2024 18:58:27 GMT

Permissions seem to be fine, and the deleted users do not show up in the passwd file.

However, the users still show up in the GUI and when I run

list user

Re: Users still showing after being deleted

fahimeh — Sun, 01 Sep 2024 12:56:22 GMT

I have the same problem as you
how did you solve it

Re: Users still showing after being deleted

wpb162 — Thu, 05 Sep 2024 19:26:56 GMT

I believe I simply needed to restart each instance after I deleted the users on it.