Splunk Enterprise Security

Splunk Enterprise Security: When a user account is deleted, what happens to Incidents closed or resolved by that user?

kiran331
Builder

HI

I have to remove a user account in Splunk. What happens to the incidents closed or resolved by that user?

0 Karma
1 Solution

jstoner_splunk
Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

View solution in original post

jstoner_splunk
Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!