Getting the following error in splunkd - Could not find user="system" with strategy="LDAP"

Path Finder

Hello community fellows,

I'm experiencing the following errors in splunkd from each of the shc members.

INFO AuthenticationManagerLDAP - Could not find user="system" with strategy="LDAP"
INFO AuthenticationManagerLDAP - Could not find user="system" with strategy="LDAP"

have checked using the following. no luck finding what is referencing system user.

find /opt/splunk/ -name *.meta -exec grep "owner = system" {} \; -print
find /opt/splunk -type f -exec grep -H 'owner = system' {} \;
find /opt/splunk -type f -exec grep -H 'user = system' {} \;

tried adding a local user, no further errors occur. can anyone suggest what may be referencing system user?

Tags (1)

Path Finder

Engineering had confirmed this as a known issue and advised this will be addressed in next patch. Awaiting to find out which will be the next patch release.


Ah thanks ran into this after patching as well.

0 Karma

Path Finder

Good to know that it is being addressed, thanks for the info.

0 Karma



I have the same issue as well.
Has the patch been released? Is there a website from Splunk to track the patches?



Hi @jamesbrock,
Did you check below splunk answer. There is lot of discussion and solution which might help you.

0 Karma

Path Finder

Hi @nikita_p,

Thanks for the reply, I did find that same post and ended up adding the user which quiets the log entries down.

0 Karma

Path Finder

you can also change the log level to quiet it down

splunk set log-level AuthenticationManagerLDAP -level NOTICE

0 Karma

Path Finder

I'm currently working on this same issue. Not able to find anything with the owner of system.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!