Splunk Enterprise Security

Splunk Enterprise Security: When a user account is deleted, what happens to Incidents closed or resolved by that user?

kiran331
Builder

HI

I have to remove a user account in Splunk. What happens to the incidents closed or resolved by that user?

0 Karma
1 Solution

jstoner_splunk
Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

View solution in original post

jstoner_splunk
Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...