Security

Saved Searches, Summary Indexes, etc - After a user leaves the company

Ricapar
Communicator

We're starting to make use of summary indexes as a way to keep statistics and metrics for an extended period of time.

However, I got a question from a user that I wasn't able to answer directly. What happens to summary indexing searches when a user leaves the company (gets deleted)?

We're using LDAP to populate users and roles. When a user leaves the company, their ID is removed from all AD groups and then deleted. This is an automated internal process that happens pretty quickly.

If a user has saved searches that are being used to generate summary indexes, will those searches suddenly stop working? Do all the objects owned by the user get deleted when the account stops coming in from LDAP?

Any best practices to avoid issues that could arise from this?

martin_mueller
SplunkTrust
SplunkTrust

When an account gets deleted from the AD, Splunk will retain its configuration objects - summary indexing will continue, so will scheduled searches powering dashboards, and so on.

You will however get warnings along the lines of "can't find user 'deleted employee' through my LDAP connection" in the _internal index. To avoid that, go to etc/apps/appname/metadata and replace that username with someone else, transferring ownership and stopping the warnings.
You can of course avoid this entirely by having special non-AD users that are to be used when something scheduled goes "live" / into a production state, but that's probably not practical in the real world.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...