Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to delete user in splunk?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
I need to remove users from splunk, which they are no longer exist in company but user is still exists in splunk
Any search query to find user, whoever not using splunk since couple of weeks.
Thanks,
Tarak
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
see these links which show a query to find user
https://answers.splunk.com/answers/233593/how-to-retrieve-current-user-in-splunk.html
https://answers.splunk.com/answers/28633/current-user-in-search.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For LDAP authentication, you can find the users who left the company and their LDAP account is deleted using following search
index=_internal sourcetype=splunkd source=*splunkd.log component=AuthenticationManagerLDAP log_level=ERROR "Could not find" | table user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
see these links which show a query to find user
https://answers.splunk.com/answers/233593/how-to-retrieve-current-user-in-splunk.html
https://answers.splunk.com/answers/28633/current-user-in-search.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks.
You forgot to vote it
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FYI:- those are LDAP users
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
