Knowledge Management

when you delete a user, do things OTHER THAN saved searches need to be "re-owned"?

matthewarguin
New Member

our splunk deployment utilizes LDAP for auth. as such, most of our users are ldap users. One of our team members recently departed and we ended up with orphaned saved searches, which i changed the owner ship to a role acct in our ldap so that they do not get orphaned in the future. When in the local.meta file, i noted that there were a pile of other items owned by the departed user. They are multiples of:

datamodels
indexes
inputs
models
props
views

do these need to be changed as well? if so, i assume the same process as the saved searches, edit the local.meta ,then hit the button on the debug refresh link?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Yes, a user can own all sorts of "knowledge objects," and all of them need to be updated if you want them to be available in the future.
Your process will work just fine. In addition to the items that you have listed, I would also check for lookups and field extractions (less likely) that were owned by this user.

You could simply search all the local.meta files for the name of the departed user, to make sure you aren't missing something.

View solution in original post

0 Karma

lguinn2
Legend

Yes, a user can own all sorts of "knowledge objects," and all of them need to be updated if you want them to be available in the future.
Your process will work just fine. In addition to the items that you have listed, I would also check for lookups and field extractions (less likely) that were owned by this user.

You could simply search all the local.meta files for the name of the departed user, to make sure you aren't missing something.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...