Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- How do I remove an LDAP user from a search head cl...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the user is removed from LDAP, then user doesn't exist in Splunk (hence the CLI command remove user won't work). The error that you're seeing is for the Splunk knowledge objects (searches/dashboards/macros etc) owned by that deleted user. To fix the errors, you would need to
1. Delete those objects (if they are no longer needed)
2. Change the ownership to a different person (same team member/replacement)
3. Change the ownership to nobody (you would need to update the scope from private to this app.
Steps on changing owner ship
For objects shared in app/global
https://answers.splunk.com/answers/52605/how-do-i-change-the-owner-of-a-saved-search.html
For Private objects, just move/copy/merge the content to appropriate etc/users/userName folder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the user is removed from LDAP, then user doesn't exist in Splunk (hence the CLI command remove user won't work). The error that you're seeing is for the Splunk knowledge objects (searches/dashboards/macros etc) owned by that deleted user. To fix the errors, you would need to
1. Delete those objects (if they are no longer needed)
2. Change the ownership to a different person (same team member/replacement)
3. Change the ownership to nobody (you would need to update the scope from private to this app.
Steps on changing owner ship
For objects shared in app/global
https://answers.splunk.com/answers/52605/how-do-i-change-the-owner-of-a-saved-search.html
For Private objects, just move/copy/merge the content to appropriate etc/users/userName folder.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Unlocking Unified Insights: New Gigamon Federated Search App for Splunk
GA: New Data Management App in Splunk Platform
Announcing Modern Navigation: A New Era of Splunk User Experience
