I'm getting this error message twice every 30 sec.
12-19-2011 12:15:27.539 -0500 ERROR AuthenticationManagerLDAP - Could not find user: bosburn
I can't figure out where I introduced this user. Our IDs do not use the name format. Did this come in from some app that I installed?
BOSBURN is the author of the app. There's apparently still some references in the app to his login ID on his own Splunk install.
You can fix this by editing $SPLUNK_HOME/etc/apps/SEP_Reporting/default/local.meta
and replace all instances of owner = bosburn
with owner = admin
.
And I'm sure someone will nag Brian to fix this and post a new version of the app.
DOH! How embarrassing. Almost like discovering that your fly was open all day.
I've uploaded a new version of the application, removing references to my username. Also, my company currently runs SEP 11, which I know isn't the latest version.
Found my answer. It comes from Symantec Endpoint Protection Reporting. The app doesn't really work right anyway. I'm removing it.
Verified that the message is no longer appearing in /opt/splunk/var/log/splunk/splunkd.log