Security

How do I remove an LDAP user from a search head cluster?

davebo1896
Communicator

I'm getting errors from a user that was removed from LDAP, how do I remove the user from the Search Head Cluster?
Note: splunk remove user does not work

Tags (4)
0 Karma
1 Solution

somesoni2
Revered Legend

If the user is removed from LDAP, then user doesn't exist in Splunk (hence the CLI command remove user won't work). The error that you're seeing is for the Splunk knowledge objects (searches/dashboards/macros etc) owned by that deleted user. To fix the errors, you would need to
1. Delete those objects (if they are no longer needed)
2. Change the ownership to a different person (same team member/replacement)
3. Change the ownership to nobody (you would need to update the scope from private to this app.

Steps on changing owner ship
For objects shared in app/global
https://answers.splunk.com/answers/52605/how-do-i-change-the-owner-of-a-saved-search.html

For Private objects, just move/copy/merge the content to appropriate etc/users/userName folder.

View solution in original post

somesoni2
Revered Legend

If the user is removed from LDAP, then user doesn't exist in Splunk (hence the CLI command remove user won't work). The error that you're seeing is for the Splunk knowledge objects (searches/dashboards/macros etc) owned by that deleted user. To fix the errors, you would need to
1. Delete those objects (if they are no longer needed)
2. Change the ownership to a different person (same team member/replacement)
3. Change the ownership to nobody (you would need to update the scope from private to this app.

Steps on changing owner ship
For objects shared in app/global
https://answers.splunk.com/answers/52605/how-do-i-change-the-owner-of-a-saved-search.html

For Private objects, just move/copy/merge the content to appropriate etc/users/userName folder.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...