Users still showing after being deleted

[wpb162]

I am trying to delete users that just use Splunk authentication. I have the admin role. I have tried both the web GUI and the CLI to delete users, but they are still visible after deletion. But something seems to have happened, because, even though the users are still showing up using the list command in the CLI, when I try to delete the user using the remove command, it says the user does not exist.

Is there a config file I need to edit to get the users to stop appearing? This is also a clustered Splunk Enterprise environment, does this mean there are further steps I have to take to delete a user?

Thanks

[fahimeh]

I have the same problem as you
how did you solve it

[wpb162 · Accepted solution]

I believe I simply needed to restart each instance after I deleted the users on it.

[PickleRick]

What are you using for authentication? If you are using external authentication source (like LDAP or SAML) your users will get re-created as soon as they authenticate using that source.

[wpb162]

Just using the local Splunk authentication (username and password), nothing external.

[PickleRick]

Another thing that comes to mind - local file permissions? (splunk process unable to alter the passwd file)

[wpb162]

Permissions seem to be fine, and the deleted users do not show up in the passwd file. 

However, the users still show up in the GUI and when I run 

list user

[KendallW]

Hi @wpb162 
It could be that the removal of the users has not propagated to all members of the SHC yet. How many members are in your SHC? How long did you leave it after running the "splunk remove user" command?

[wpb162]

3 members in the cluster, has not updated since I made the change yesterday, even on the instance I made the change on.

[deepakc]

Removing users is a standard splunk admin task, so this is odd!.

If you look at your config, what does this state? 

If you run the btool command and check your authentication config? 

/opt/splunk/bin/splunk cmd btool authentication list --debug