Security

How do you actually delete a user in the Splunk web UI?

gsypsomos
Engager

When I go to Users in the Splunk web UI, there is no option/action available next to the user accounts. I have tried with the admin account as well as with power user accounts. Using Splunk 6.5.2.

Tags (1)
0 Karma

somesoni2
Revered Legend

If you're using LDAP authentication OR any other non-native method for authenticating/adding users in your environment, you'll not be able to delete User from Splunk Web UI. You need to remove users from those source systems. E.g. If you're using LDAP authentication, to remove a user from Splunk, remove it from the splunk LDAP group is associated with.

gsypsomos
Engager

This was the solution. We are using LDAP, so I logged on to a Windows server and managed active directory users and computers, performed a Find for the user account, and then looked at the group memberships that the user belonged to. I removed their memberships in the Splunk management AD group, and their account disappeared from Splunk.

Thank you, somesoni2.

0 Karma

somesoni2
Revered Legend

I've converted my comment to an answer so that you can mark your question resolved by accepting the same.

0 Karma

niketn
Legend

@gsypsomos, is this for Splunk built in Access Control?

With Admin role you should be able to delete Users. However, if you are not able to can you try one of the following:

1) Try with a user with can_delete role.
2) Try DELETE user via REST API to see if you have access to delete or not
http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTaccess#authentication.2Fusers.2F.7Bnam...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

MuS
SplunkTrust
SplunkTrust

Two things to add:

  1. you cannot delete a user if you are logged on as this user
  2. you cannot delete a LDAP user

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...