How to delete LDAP users

Available Languages

Updated:September 28, 2026
Document ID:SPLK044531

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

When using LDAP for authentication users are still showing on Splunk after being deleted. 


 

Investigation

Splunk Enterprise does not automatically remove the corresponding Splunk user. Usually, this is not an issue, but if the user has global permissions of any sort, LDAP may generate errors.


Resolution

Steps to properly delete a Splunk user:

  1. Back up the $HOME/splunk/etc/users/$userid folder.
  2. Search the files under $HOME/splunk/etc/apps/ for the user ID string to see if the user owns any searches or objects with global permissions.
  3. Reassign one or more shared knowledge objects to a new owner
  4. On search heads, review splunkd.log to confirm there are no LDAP authentication errors associated with the user.
  5. Once you have redirected object ownership, you can safely remove the $HOME/splunk/etc/users/$userid folder.
  6. Reload Authentication configuration Settings > Access controls > Authentication method > "External" LDAP > Reload authentication configuration.

Remove an LDAP user safely on Splunk Enterprise

Reassign one or more shared knowledge objects to a new owner

 

Revision History

Revision Publish Date Comments
1.0
28-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products