How can I completely delete a user in Splunk ES?

[fahimeh]

Hello,

As an admin, I deleted a user in Splunk Web, but when I try to add a user during an investigation, I still see the deleted user in the list. Why is this happening?

Is there a conflict between deleting users in Splunk Enterprise and Splunk ES?

[gcusello]

Hi @fahimeh ,

ES hasn't its own authentication method, it uses users from Splunk Enterprise, it only has its own roles.

If you delete an user in Splunk Enterprise its isn't possible for that user access the system, but probably the investigation and action from tha user continue to remain in the system, even if if you search an object created by that user you find an orphaned object.

Ciao.

Giuseppe

[vr2312 · Accepted solution]

The names of the investigators are populated in the KV Store, user_realnames, Here are steps that needs to be taken for removing the old investigators.

1. Navigate to the app "Splunk App for Lookup File Editing" for editing the KV Store.
2. On the Lookups page, find the “user_realnames_lookup” file and edit it
3. Delete the users who are not part of the organization currently. To Delete, select any cell in the table and right click you will see options to delete the selected rows if needed.
4. Ensure that the profiles no longer appear in the investigators section after the lookup update.

[fahimeh]

hi @vr2312 

Thank you for your response; it was completely correct.