Security

LDAP errors after an employee is replaced and ownerships were edited in $SPLUNK_HOME/etc//metadata/local.meta

rcreddy06
Path Finder

We have an employee replacement and the saved searches & objects ownership was changed from $SPLUNK_HOME/etc/<app>/metadata/local.meta file and restarted splunkd. All the objects were accessible & reports are running fine under new employee's ID. But I still see LDAP error logs "User not found". He's still in the LDAP. I believe the errors in splunkd is caused by $SPLUNK_HOME/etc/users/<Employee-ID>. If I delete the folder , What is its impact?

1 Solution

Raghav2384
Motivator

+1 to jkat's answer...also, if you edit anything in local.meta and save, you don't need a splunk restart. It will refresh eventually or you can trigger

splunk _internal call /authentication/providers/services/_reload -auth admin:password

If the status return is 200, you are good!

Thanks,
Raghav

jkat54
SplunkTrust
SplunkTrust

Yeah you should probably have a script for hitting this endpoint on every server in your environment and run the script daily and after any role based access changes.

The idea of doing it daily is more of a precaution you MIGHT want to implement. It doesn't hurt anything to hit this endpoint, but unless your company is turning over employees daily, there's probably no need to hit it daily.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...