Hi,
I am getting messages in splunkd.log about accounts that do not exist in my splunk instances and that don't exist within my company.
07-30-2017 12:20:19.386 -0400 INFO AuthenticationManagerLDAP - Could not find user="auser" with strategy="zzgEI_SOMM_Splunk_Users"
Why would I get these?
Some knowledge objects still exist under usernames that no longer exist in the environment. If they are search objects (most likely) then you can Reassign one or more shared knowledge objects to a new owner.
I've seen it a bazillion times. It's nothing to worry about but good to clean up.
Someone tried to login to Splunk as "auser" and the user doesn't exist in your LDAP.
Or perhaps you have an eventgen app installed that is generating the data.
Is your Splunk open to users on the internet?
