LDAP cache does not appear be refreshed periodiodically do you have any method to empty the cache?
There are a few ways to clean up the cache;
i) Restart of splunk,
ii) Or run comand below;
./splunk _internal call /authentication/providers/services/_reload -auth admin:changeme
iii) Or hit the rest endpoint;
"| rest splunk_server=* /services/authentication/providers/services/_reload "
There are a few ways to clean up the cache;
i) Restart of splunk,
ii) Or run comand below;
./splunk _internal call /authentication/providers/services/_reload -auth admin:changeme
iii) Or hit the rest endpoint;
"| rest splunk_server=* /services/authentication/providers/services/_reload "