Splunk Enterprise Security: When a user account is deleted, what happens to Incidents closed or resolved by that user?

[kiran331]

HI

I have to remove a user account in Splunk. What happens to the incidents closed or resolved by that user?

[jstoner_splunk · Accepted solution]

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.