User removed from LDAP but splunk still shows the user?

New Member



I have a use case where user has been removed from the LDAP , but when we check in the user via setting , we see the user still exists


Ideally automatically user should also be removed from splunk 

Labels (2)
0 Karma


That's normal.  Splunk consults the LDAP server when a user logs in, but the LDAP server does not notify Splunk when a user is removed (or added).

Once you've reassigned the user's assets to another user, you can delete the user manually.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...