If I delete a local user account from a search head, what happens to that user's apps and reports?

[kiran331]

Hi

I have to delete a user (local account) from a Splunk Search Head. The user has some apps, reports ownership. What happens to those apps and reports if I delete the user account? Is there a better way to delete the account without affecting the apps and reports?

[ddrillic · Accepted solution]

They are completely independent entities, so it's safe to delete the user.

You might run into the situation of orphaned entities which the following page explains - Resolve orphaned searches, reports, and alerts