Saved Searches, Summary Indexes, etc - After a user leaves the company

[Ricapar]

We're starting to make use of summary indexes as a way to keep statistics and metrics for an extended period of time.

However, I got a question from a user that I wasn't able to answer directly. What happens to summary indexing searches when a user leaves the company (gets deleted)?

We're using LDAP to populate users and roles. When a user leaves the company, their ID is removed from all AD groups and then deleted. This is an automated internal process that happens pretty quickly.

If a user has saved searches that are being used to generate summary indexes, will those searches suddenly stop working? Do all the objects owned by the user get deleted when the account stops coming in from LDAP?

Any best practices to avoid issues that could arise from this?

[martin_mueller]

When an account gets deleted from the AD, Splunk will retain its configuration objects - summary indexing will continue, so will scheduled searches powering dashboards, and so on.

You will however get warnings along the lines of "can't find user 'deleted employee' through my LDAP connection" in the _internal index. To avoid that, go to etc/apps/appname/metadata and replace that username with someone else, transferring ownership and stopping the warnings.
You can of course avoid this entirely by having special non-AD users that are to be used when something scheduled goes "live" / into a production state, but that's probably not practical in the real world.