/splunk_clean_orphaned_user

Bash script to remove an orphaned user from Splunk

Primary LanguageShell

Bash script to reassign all shared artifacts (knowledge objects, KOs) from an orphaned user to a new user.

Private KOs are simply moved out of the users directory to a backup location.

If you run on a search head cluster, you'll need to run it on all members.

A restart will be required once all runs are finished.