User removed from LDAP but splunk still shows the user?

New Member



I have a use case where user has been removed from the LDAP , but when we check in the user via setting , we see the user still exists


Ideally automatically user should also be removed from splunk 

Labels (2)
0 Karma


That's normal.  Splunk consults the LDAP server when a user logs in, but the LDAP server does not notify Splunk when a user is removed (or added).

Once you've reassigned the user's assets to another user, you can delete the user manually.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...