How do I remove an LDAP user from a search head cluster?

[davebo1896]

I'm getting errors from a user that was removed from LDAP, how do I remove the user from the Search Head Cluster?
Note: splunk remove user does not work

[somesoni2 · Accepted solution]

If the user is removed from LDAP, then user doesn't exist in Splunk (hence the CLI command remove user won't work). The error that you're seeing is for the Splunk knowledge objects (searches/dashboards/macros etc) owned by that deleted user. To fix the errors, you would need to
1. Delete those objects (if they are no longer needed)
2. Change the ownership to a different person (same team member/replacement)
3. Change the ownership to nobody (you would need to update the scope from private to this app.

Steps on changing owner ship
For objects shared in app/global
https://answers.splunk.com/answers/52605/how-do-i-change-the-owner-of-a-saved-search.html

For Private objects, just move/copy/merge the content to appropriate etc/users/userName folder.