- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Currently on Splunk ES 7.3.2
Splunk Enterprise Security
where i can see users, who used to be part of the organisation, but are now deleted/disabled (in Splunk) are still populating when i try to assign new investigations to other current members of the organisation
For instance, Incident Review -> Notable -> Create Investigation
In the investigation panel, when i try to assign the investigation to other members of the team, i can also see disabled/deleted accounts/users/members as an option to assign the investigation to.
Any way we can remove these members from populating so that the list of investigators replicate the current numbers we have in the team.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Adding the solution to this so that it can help others.
The names of the investigators are populated in the KV Store, user_realnames, Here are steps that needs to be taken for removing the old investigators.
- Navigate to the app "Splunk App for Lookup File Editing" for editing the KV Store.
- On the Lookups page, find the “user_realnames_lookup” file and edit it
- Delete the users who are not part of the organization currently. To Delete, select any cell in the table and right click you will see options to delete the selected rows if needed.
- Ensure that the profiles no longer appear in the investigators section after the lookup update.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Adding the solution to this so that it can help others.
The names of the investigators are populated in the KV Store, user_realnames, Here are steps that needs to be taken for removing the old investigators.
- Navigate to the app "Splunk App for Lookup File Editing" for editing the KV Store.
- On the Lookups page, find the “user_realnames_lookup” file and edit it
- Delete the users who are not part of the organization currently. To Delete, select any cell in the table and right click you will see options to delete the selected rows if needed.
- Ensure that the profiles no longer appear in the investigators section after the lookup update.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the same problem
What did you do to solve it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi @fahimeh , i just added the solution to this on to the post. Please upvote for more reach 🙂
