×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Reece
Loves-to-Learn
Member since: ‎09-24-2024
‎10-31-2024
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎09-24-2024
View All

Re: Inability to delete alerts/reports after LDAP ...

by in Splunk Search
‎09-26-2024 06:21 AM
‎09-26-2024 06:21 AM
I have elected a new captain in my SH cluster a few times over the course of a couple days to see if there was some type of connection issue b/w specific SHs but still presenting same error. The only changes in auth.conf were the ldap servers, the hosts, the groupings and permissions are all identical.  ... View more

Inability to delete alerts/reports after LDAP upda...

by in Splunk Search
‎09-24-2024 09:58 AM
‎09-24-2024 09:58 AM
Hello, I recently updated a distributed environment with a bundle via the deployer to update the authentication.conf to have an updated LDAP strategy.  Since then there have been a number of issue with users not being able to delete their knowledge objects which prompted me to try as my Admin user. However this is the error I am receiving when trying to delete via the web ui: 09-24-2024 16:52:13.948 +0000 ERROR SavedSearchAdminHandler [2802356 TcpChannelThread] - This saved search failed to handle removal request due to Object id=<alert/report name> cannot be deleted in config=savedsearches. I am using Splunk Enterprise version 9.3.0. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-31-2024 02:40 PM