Splunk Enterprise

What's an authDB in current Splunk? What was it in old versions of Splunk?

jrodman
Splunk Employee
Splunk Employee

I see I have an "index" var/lib/splunk/authDB with nothing in it. Do I need this? Does Splunk need to maintain support for this indefinitely?

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

It is of no use in Splunk 3.4, 4.0 or 4.1, and can be deleted. It seems to me that it was probably useless in all 3.x releases, but I don't feel it's worth checking. At some older version before this, it appeared to contain user-related information. This data is in configuration files in later releases.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

It is of no use in Splunk 3.4, 4.0 or 4.1, and can be deleted. It seems to me that it was probably useless in all 3.x releases, but I don't feel it's worth checking. At some older version before this, it appeared to contain user-related information. This data is in configuration files in later releases.

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...