How do you actually delete a user in the Splunk web UI?

[gsypsomos]

When I go to Users in the Splunk web UI, there is no option/action available next to the user accounts. I have tried with the admin account as well as with power user accounts. Using Splunk 6.5.2.

[somesoni2]

If you're using LDAP authentication OR any other non-native method for authenticating/adding users in your environment, you'll not be able to delete User from Splunk Web UI. You need to remove users from those source systems. E.g. If you're using LDAP authentication, to remove a user from Splunk, remove it from the splunk LDAP group is associated with.

[gsypsomos]

This was the solution. We are using LDAP, so I logged on to a Windows server and managed active directory users and computers, performed a Find for the user account, and then looked at the group memberships that the user belonged to. I removed their memberships in the Splunk management AD group, and their account disappeared from Splunk.

Thank you, somesoni2.

[somesoni2]

I've converted my comment to an answer so that you can mark your question resolved by accepting the same.

[niketn]

@gsypsomos, is this for Splunk built in Access Control?

With Admin role you should be able to delete Users. However, if you are not able to can you try one of the following:

1) Try with a user with can_delete role.
2) Try DELETE user via REST API to see if you have access to delete or not
http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTaccess#authentication.2Fusers.2F.7Bnam...

[MuS]

Two things to add:

1. you cannot delete a user if you are logged on as this user
2. you cannot delete a LDAP user

cheers, MuS