Monitoring Splunk

Splunk "strategy=" error on startup

OldManEd
Builder

I'm trying to "clean-up" an inherited instance of Splunk before going to release 6.1.3. I've noticed that in the splunkd.log file, when I restart Splunk, I get the following error;

09-15-2014 09:05:41.663 -0700 ERROR AuthenticationManagerLDAP - Could not find user="<UID>" with strategy="SplunkAD"
09-15-2014 09:05:41.664 -0700 ERROR UserManagerPro - Failed to get LDAP user="<UID>" from any configured servers

Does anyone know what's going on here? I've deleted the UID from the "/opt/splunk/etc/users" directory and changed any mention of the UID in "/opt/splunk/etc/apps//metadata/local.meta" to admin.

As always, any help would be greatly appreciated.

Tags (3)
0 Karma
1 Solution

OldManEd
Builder

I ran a "grep" from /opt/splunk looking at ~everything~ for the UID - nothing. I reviewed the searches and everything else I could think of looking for the UID causing the error - again nothing. As a last resort I selected the "Jobs" tab from the Splunk search window and entered "App=All” and “Owner-All”. I then entered the UID that has been giving me problems and it came back with 2 entries from 2011. I deleted them both and the errors have stopped.

Thanks for everyone's help on this one.

View solution in original post

OldManEd
Builder

I ran a "grep" from /opt/splunk looking at ~everything~ for the UID - nothing. I reviewed the searches and everything else I could think of looking for the UID causing the error - again nothing. As a last resort I selected the "Jobs" tab from the Splunk search window and entered "App=All” and “Owner-All”. I then entered the UID that has been giving me problems and it came back with 2 entries from 2011. I deleted them both and the errors have stopped.

Thanks for everyone's help on this one.

martin_mueller
SplunkTrust
SplunkTrust

Usually there's some saved/scheduled search still around under that name. Double-check all the metadata to be sure.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...