Temporary user access

[tmarlette]

I have a team of users who only need brief access to my splunk environment.

Is there a way to take either a user or a role, and apply them, say for 30 day's, and then the accounts are disabled / deleted?

[martin_mueller · Accepted solution]

I don't think there's a way to do automatic user expiry with Splunk's built-in authentication. However, with external authentication you could do this, for example by setting an account expiration date in your Active Directory linked to Splunk over LDAP. Once expired in AD the user won't be able to login to Splunk either.

As a blunt-force workaround with Splunk's built-in authentication you could give your users a name like john_doe_2014-06-01 and schedule a script to run every night on your search head, looking for users that expired based on that date and deleting them through Splunk's CLI.

For a more involved workaround with Splunk's built-in authentication you could look at when a user was created like this:

| rest /services/authentication/users | fields title | join title [search index=_audit operation=create action=edit_user | stats latest(_time) as created by object | rename object as title]

If your users are named like john_doe_30d then you could build an appropriate filter for users that have expired, and use that to delete users. That's not possible from the search bar, but should work from an alert script, custom search command, or the CLI.