Security

User has left the company, now getting "Could not find user:" errors

mikelanghorst
Motivator

I've had a few users leave the company now that have had saved searches. Removing the $splunk_home/etc/users/ directory doesn't resolve the errors.

If I search for files that contain the login name, I find the following example entry for "tuser"q:
etc/apps/search/local/viewstates.conf:
[viewstates/flashtimeline%3Agu5s5mv8]
owner = tuser
version = 4.2.3
export = system

Is it safe to remove these entries? Is there a better way to remove terminated users?

Tags (1)

Brian_Osburn
Builder

Make sure the users not in any meta files either. If you're on a linux machine I'd do the following:

grep -r "username" $SPLUNK_HOME

That'll find all instances of the user name in any configuration files.

mikelanghorst
Motivator

Removing those entries in viewstates.conf doesn't resolve the error either.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...