- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
fahimeh
Explorer
09-01-2024
03:30 AM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vr2312
Builder
09-01-2024
06:38 PM
The names of the investigators are populated in the KV Store, user_realnames, Here are steps that needs to be taken for removing the old investigators.
- Navigate to the app "Splunk App for Lookup File Editing" for editing the KV Store.
- On the Lookups page, find the “user_realnames_lookup” file and edit it
- Delete the users who are not part of the organization currently. To Delete, select any cell in the table and right click you will see options to delete the selected rows if needed.
- Ensure that the profiles no longer appear in the investigators section after the lookup update.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gcusello
SplunkTrust
09-02-2024
12:53 AM
Hi @fahimeh ,
ES hasn't its own authentication method, it uses users from Splunk Enterprise, it only has its own roles.
If you delete an user in Splunk Enterprise its isn't possible for that user access the system, but probably the investigation and action from tha user continue to remain in the system, even if if you search an object created by that user you find an orphaned object.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vr2312
Builder
09-01-2024
06:38 PM
The names of the investigators are populated in the KV Store, user_realnames, Here are steps that needs to be taken for removing the old investigators.
- Navigate to the app "Splunk App for Lookup File Editing" for editing the KV Store.
- On the Lookups page, find the “user_realnames_lookup” file and edit it
- Delete the users who are not part of the organization currently. To Delete, select any cell in the table and right click you will see options to delete the selected rows if needed.
- Ensure that the profiles no longer appear in the investigators section after the lookup update.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
fahimeh
Explorer
09-07-2024
02:41 AM