A user called "seguridad" created in Radius but already eliminated is still visible in Splunk console (see images below). Initially the customer was in Splunk 6.3. We upgraded, first to 6.5 and finally to Splunk 7.1.2, but the issue persists. Also, the folder of this user was eliminated from path $HOME/splunk/etc/users. Any idea of what else is missing to eliminate this user?
If you remove or modify the group or user , you need to tell Splunk to reload the authentication using either this REST call
| rest splunk_server=* /services/authentication/providers/services/_reload
or this CLI Splunk command
./splunk _internal call /authentication/providers/services/_reload -auth
Let me know if this helps!!