Security

Why is a Radius user who we've eliminated still visible in Splunk Enterprise?

luis290311
Explorer

A user called "seguridad" created in Radius but already eliminated is still visible in Splunk console (see images below). Initially the customer was in Splunk 6.3. We upgraded, first to 6.5 and finally to Splunk 7.1.2, but the issue persists. Also, the folder of this user was eliminated from path $HOME/splunk/etc/users. Any idea of what else is missing to eliminate this user?
alt text

0 Karma

luis290311
Explorer

alt text

0 Karma

deepashri_123
Motivator

Hey@luis290311,

If you remove or modify the group or user , you need to tell Splunk to reload the authentication using either this REST call
| rest splunk_server=* /services/authentication/providers/services/_reload

or this CLI Splunk command

 ./splunk _internal call /authentication/providers/services/_reload -auth

Let me know if this helps!!

luis290311
Explorer

Thanks for colaborating, deepashri_123. Customer tested the splunk_internal command but he says the user is still there. Below I'm attaching a picture with the output of the command.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...