We use LDAP for user authentication. We have many, many users. Anyone have a search or script where I can find users that no longer exist in LDAP so that I can remove their user directories from Splunk?
Another way to address the issue is how can I go through the list of user directories and validate that the user for that directory still exists? (Linux)
Hi rmorlen,
You can try the solution provided here http://answers.splunk.com/answers/107574/track-users-logging-in-via-sso.html or use the LDAP add on http://apps.splunk.com/app/1852 which enables Splunk to perform nativ LDAP queries and browser for the user on your LDAP server.
Hope that helps ...
cheers, MuS