I have SAML on my SHC, but LDAP on my indexers. (There is a security rational for that, but I'm not going into those details.)
The splunkd.log on my indexers has these errors:
ERROR UserManagerPro - Could not get info for non-existent user="email@example.com"
I would like to eliminate that error from clogging the internal logs, but don't know how.
I have a Splunk bug logged where I get a:
Failed to get LDAP user from any
This only happens on the indexer level, even though the searches are running from the search head. The fix is due in 6.5.3 which is hopefully due out soon.
It is a minor annoyance if you have hit the same issue...however there are other possibilities as per the comments above, I believe the issue appeared in 6.5.0 from memory...(or a late 6.4.x version)
You'll have to change those single quotes to back ticks. I don't have them on my phones keyboard.
You may have to change the 10 to a larger number to see the stanza / saved search name too. -C in grep manes give me x lines before and after the match
Did the indexers ever use SAML?
Chech out the folders here (assuming your on nix) on the indexers
Should be full of usernames and under there the individual user's knowledge objects.
That's a starting point. Beyond that there can be searches with runAs set to specific users.
Maybe could find those like this:
for i in 'find /opt/splunk/etc -type f -name "savedsearches.conf" '; do echo;do echo $i; cat $i | grep -C 10 -i lycollicott; done