Hi jkeellogic,
If you have CLI access to the server, fine. First check in the Splunk UI at URI http[s]:YourSplunkServer:[YourSplunkPort]/en-GB/manager/search/data/lookup-table-files and http[s]:YourSplunkServer:[YourSplunkPort]/en-GB/manager/search/data/transforms/lookups where you can find the files on your Splunk server. Then login and change directory to this folder and modify any props.conf and transforms.conf containing information related to this lookup.
There is also a REST API method to change the setting, but modifying the files is much easier.
And if I got your completely wrong and you want to remove the user account, simply edit $SPLUNK_HOME/etc/passwd and remove the user in this file and restart Splunk.
Hope that helps ...
cheers, MuS
... View more