Splunk Enterprise Security

How to troubleshoot unknown role warnings for 'ess_analyst' in Splunkd.log, even after uninstalling the Splunk App for Enterprise Security?

jravida
Communicator

Hi folks,

I seem to have the remnants of a role, being called up, and failing to exist. The role is related to the Enterprise Security app, 'ess_analyst', although the app has been since uninstalled. The splunkd.log only says:
WARN AuthroizationManager - Unknown role 'ess_analyst'
It says this thousands of times, crowding out the important logs as they just roll over.
The role doesn't exist at all when I check my roles. I'm not sure where else to look, as the error is vague.

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I'd start by grepping through $SPLUNK_HOME/etc for files that contain ess_analyst.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I'd start by grepping through $SPLUNK_HOME/etc for files that contain ess_analyst.

jravida
Communicator

Good call! The string showed up in authorize.conf, as an inherited role for a new one someone had made. I went back to the GUI, and brought up the new role, didn't see 'ess_analyst'. I added and removed the user role, and saved. Went back to splunkd.log and the WARN has stopped! Check authorize.conf, role is gone! Ghosts of roles past, I guess. I hope I don't get visited by 2 more before Chiristmas, because I have places to go.

martaBenedetti
Path Finder

Worked for me, thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...