Security

LDAP errors after an employee is replaced and ownerships were edited in $SPLUNK_HOME/etc//metadata/local.meta

rcreddy06
Path Finder

We have an employee replacement and the saved searches & objects ownership was changed from $SPLUNK_HOME/etc/<app>/metadata/local.meta file and restarted splunkd. All the objects were accessible & reports are running fine under new employee's ID. But I still see LDAP error logs "User not found". He's still in the LDAP. I believe the errors in splunkd is caused by $SPLUNK_HOME/etc/users/<Employee-ID>. If I delete the folder , What is its impact?

1 Solution

Raghav2384
Motivator

+1 to jkat's answer...also, if you edit anything in local.meta and save, you don't need a splunk restart. It will refresh eventually or you can trigger

splunk _internal call /authentication/providers/services/_reload -auth admin:password

If the status return is 200, you are good!

Thanks,
Raghav

jkat54
SplunkTrust
SplunkTrust

Yeah you should probably have a script for hitting this endpoint on every server in your environment and run the script daily and after any role based access changes.

The idea of doing it daily is more of a precaution you MIGHT want to implement. It doesn't hurt anything to hit this endpoint, but unless your company is turning over employees daily, there's probably no need to hit it daily.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...