Security

LDAP errors after an employee is replaced and ownerships were edited in $SPLUNK_HOME/etc//metadata/local.meta

rcreddy06
Path Finder

We have an employee replacement and the saved searches & objects ownership was changed from $SPLUNK_HOME/etc/<app>/metadata/local.meta file and restarted splunkd. All the objects were accessible & reports are running fine under new employee's ID. But I still see LDAP error logs "User not found". He's still in the LDAP. I believe the errors in splunkd is caused by $SPLUNK_HOME/etc/users/<Employee-ID>. If I delete the folder , What is its impact?

1 Solution

Raghav2384
Motivator

+1 to jkat's answer...also, if you edit anything in local.meta and save, you don't need a splunk restart. It will refresh eventually or you can trigger

splunk _internal call /authentication/providers/services/_reload -auth admin:password

If the status return is 200, you are good!

Thanks,
Raghav

jkat54
SplunkTrust
SplunkTrust

Yeah you should probably have a script for hitting this endpoint on every server in your environment and run the script daily and after any role based access changes.

The idea of doing it daily is more of a precaution you MIGHT want to implement. It doesn't hurt anything to hit this endpoint, but unless your company is turning over employees daily, there's probably no need to hit it daily.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...