In handler ‘users’: Could not get info for role that does not exist: winfra-admin

In handler ‘users’: Could not get info for role that does not exist: winfra-admin

The above splunk error can be encountered when changing the password for users with the winfra-admin role, after the uninstallation of splunk app for windows infrastructure.

IMG-20181004-WA0002

To fix this error,

i) Find and delete residual files (if any) related to splunk app for windows infrastructure, can be found in $SPLUNK_HOME\etc\users\<user_name>, $SPLUNK_HOME\etc\apps located under the folder splunk_app_windows_infrastructure OR you can delete the entire foldersplunk_app_windows_infrastructure” .

A sample image is given below 
(admin is an user, so it appears in $SPLUNK_HOME\etc\users)

screenshot-5.png

ii) Remove the winfra-admin entry from splunk passwd file located in $SPLUNK_HOME\etc.

NOTE: IF you are unable to open the passwd file due to permission issues, then copy & paste it to a different location (ex- desktop) and edit it. Once done, you can replace the original passwd file in $SPLUNK_HOME\etc with the edited copy.  

Screenshot (7)

iii) Restart your splunk.

Now try to change your password, you must be able to do it this time !!

Happy Splunking !!

 

Advertisements

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.