Why is a Radius user who we've eliminated still visible in Splunk Enterprise?

[luis290311]

A user called "seguridad" created in Radius but already eliminated is still visible in Splunk console (see images below). Initially the customer was in Splunk 6.3. We upgraded, first to 6.5 and finally to Splunk 7.1.2, but the issue persists. Also, the folder of this user was eliminated from path $HOME/splunk/etc/users. Any idea of what else is missing to eliminate this user?

[luis290311]

[deepashri_123]

Hey@luis290311,

If you remove or modify the group or user , you need to tell Splunk to reload the authentication using either this REST call
| rest splunk_server=* /services/authentication/providers/services/_reload

or this CLI Splunk command

 ./splunk _internal call /authentication/providers/services/_reload -auth

Let me know if this helps!!

[luis290311]

Thanks for colaborating, deepashri_123. Customer tested the splunk_internal command but he says the user is still there. Below I'm attaching a picture with the output of the command.