Splunk Enterprise Security

Splunk Enterprise Security: When a user account is deleted, what happens to Incidents closed or resolved by that user?

kiran331
Builder

HI

I have to remove a user account in Splunk. What happens to the incidents closed or resolved by that user?

0 Karma
1 Solution

jstoner_splunk
Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

View solution in original post

jstoner_splunk
Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...