Security

Splunk searches from deleted users

rgtsplunk
Explorer

We can see in our splunkd.log that is showing the following errors:

UserManagerPro - Failed to get LDAP user="xxx" from any configured servers
AuthenticationManagerLDAP - user="xxx" has matching LDAP groups with strategy="yyyy", but none are mapped to Splunk roles

We also get some error messages with 'user="splunk"', but have no user splunk. They are not the same as those run by splunk-system-user.

These users were removed, and should not be running searches. Yet these messages are consistently being reported. We would like to know what searches they apply to, so we can disable the searches, or move them to another user. But the message does not say what searches are running, nor give us any information to go on. Any ideas?

Richard Thomsen

Tags (1)
1 Solution

piebob
Splunk Employee
Splunk Employee

you're most likely seeing saved searches created by these users that are run on a schedule. to see the owners of saved searches, you can look in Manager > Searches and reports.

once there, you can use the search box on the right to look for those usernames, or filter by app.

to change the owner of a search defined in $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf, edit the ownership and permissions defined in etc/apps/search/metadata/local.meta. you'll need to substitute the app name of any app you're working on for 'search'

you will have to restart splunk to see the change.

View solution in original post

piebob
Splunk Employee
Splunk Employee

you're most likely seeing saved searches created by these users that are run on a schedule. to see the owners of saved searches, you can look in Manager > Searches and reports.

once there, you can use the search box on the right to look for those usernames, or filter by app.

to change the owner of a search defined in $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf, edit the ownership and permissions defined in etc/apps/search/metadata/local.meta. you'll need to substitute the app name of any app you're working on for 'search'

you will have to restart splunk to see the change.

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...