Splunk Search



I'm getting this error message twice every 30 sec.
12-19-2011 12:15:27.539 -0500 ERROR AuthenticationManagerLDAP - Could not find user: bosburn

I can't figure out where I introduced this user. Our IDs do not use the name format. Did this come in from some app that I installed?


BOSBURN is the author of the app. There's apparently still some references in the app to his login ID on his own Splunk install.

You can fix this by editing $SPLUNK_HOME/etc/apps/SEP_Reporting/default/local.meta and replace all instances of owner = bosburn with owner = admin.

And I'm sure someone will nag Brian to fix this and post a new version of the app.


DOH! How embarrassing. Almost like discovering that your fly was open all day.

I've uploaded a new version of the application, removing references to my username. Also, my company currently runs SEP 11, which I know isn't the latest version.


Found my answer. It comes from Symantec Endpoint Protection Reporting. The app doesn't really work right anyway. I'm removing it.

Verified that the message is no longer appearing in /opt/splunk/var/log/splunk/splunkd.log

Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...