This can happen if you have knowledge objects (searches, lookups, extractions) owned by a user who was at one point a user but now been removed.
Splunk will look for users initially in the local auth DB, and if not found will search LDAP. If it cant find that user in an LDAP DS, it will log that error
Splunk 'hides' KOs from the UI if the user does not exist, so you will need to grep through your meta files for that username, and change the owner to someone who still exists and the errors will cease.
... View more