Why am I getting "WARN AuthorizationManager - Unknown role" errors in splunkd.log after deleting the VMware and Windows Infrastructure apps?

[bravon]

After removing the Windows Infrastructure and VMWare applications, we get the following errors in splunkd.log:

WARN AuthorizationManager - Unknown role 'winfra-admin'
WARN AuthorizationManager - Unknown role 'splunk_vmware_admin'

I can't seem to find where the old (deleted/removed) roles are referenced - can someone point me in the right direction?

[azurite257]

It's not the authorized.conf. ess_user, ess_admin, ess_analysts would have been additional roles associated with admin account or other users defined local to the splunk (i.e. if you are using LDAP, then only system accounts that should be defined would have been admin).

Look at the $SPLUNK_HOME/etc/passwd. remove the roles associated that is no-longer existing on that splunk instance. That should get rid of the errors in the log.

:admin:$$::Administrator:admin;ess_admin;ess_analyst:changeme@example.com::

In above example, remove the entries ';ess_admin;ess_analyst' and save. Restart splunk, and error will be gone.

[bravon · Accepted solution]

After reading http://answers.splunk.com/answers/205496/how-to-troubleshoot-unknown-role-warnings-for-ess.html i found a reference in etc\system\local\authorize.conf