Security

Why is a Radius user who we've eliminated still visible in Splunk Enterprise?

luis290311
Explorer

A user called "seguridad" created in Radius but already eliminated is still visible in Splunk console (see images below). Initially the customer was in Splunk 6.3. We upgraded, first to 6.5 and finally to Splunk 7.1.2, but the issue persists. Also, the folder of this user was eliminated from path $HOME/splunk/etc/users. Any idea of what else is missing to eliminate this user?
alt text

0 Karma

luis290311
Explorer

alt text

0 Karma

deepashri_123
Motivator

Hey@luis290311,

If you remove or modify the group or user , you need to tell Splunk to reload the authentication using either this REST call
| rest splunk_server=* /services/authentication/providers/services/_reload

or this CLI Splunk command

 ./splunk _internal call /authentication/providers/services/_reload -auth

Let me know if this helps!!

luis290311
Explorer

Thanks for colaborating, deepashri_123. Customer tested the splunk_internal command but he says the user is still there. Below I'm attaching a picture with the output of the command.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...