We have an employee replacement and the saved searches & objects ownership was changed from $SPLUNK_HOME/etc/<app>/metadata/local.meta file and restarted splunkd. All the objects were accessible & reports are running fine under new employee's ID. But I still see LDAP error logs "User not found". He's still in the LDAP. I believe the errors in splunkd is caused by $SPLUNK_HOME/etc/users/<Employee-ID>. If I delete the folder , What is its impact?
↧