What's the quickest way to lock a user out of Splunk?

[the_wolverine]

We've discovered a malicious user (hypothetical) using our Splunk instance. What's the quickest way to lock out this user?

[the_wolverine · Accepted solution]

If its a local user, change the user's password.

If its an ldap user, create a local account for that user which will override the ldap account.