Security

How to delete authorization token for non-existent user?

justynap_ldz
Path Finder

Hello,

Does anyone know how to delete an authorization token for no more exisiting account in Splunk?
We have tried it in Web, but Splunk "Could not get info for non-existent user"

justynap_ldz_1-1689923652683.png

We have tried it on servers, too:
For curl -k -u <username>:<password> -X DELETE https://<server>:<management_port>/services/authorization/tokens/<token_user> -d id=<token_id>
we get:
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Could not find object id=xxxxx</msg>
</messages>
</response>

Is there any dir or file where authentication tokens are saved on Search Heads? 
We need to get rid of internal errors that we receive for this non-existent user, but without token removal it will not be possible

Many thanks in advance for help!

Greetings,
Justyna

Labels (4)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

GUI didn't remove it? As I understand that pop up it still give you a possibility to remove token, even it cannot found user?

One option what you could try is just create a local Splunk user (exact same user id as earlier), then remove token and then remove user?

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

GUI didn't remove it? As I understand that pop up it still give you a possibility to remove token, even it cannot found user?

One option what you could try is just create a local Splunk user (exact same user id as earlier), then remove token and then remove user?

r. Ismo

justynap_ldz
Path Finder

Hi @isoutamo
It worked, thank you for your prompt reply!
Much appreciated

BR,
Justyna

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...