In handler ‘users’: Could not get info for role that does not exist: winfra-admin
The above splunk error can be encountered when changing the password for users with the winfra-admin role, after the uninstallation of splunk app for windows infrastructure.
To fix this error,
i) Find and delete residual files (if any) related to splunk app for windows infrastructure, can be found in $SPLUNK_HOME\etc\users\<user_name>, $SPLUNK_HOME\etc\apps located under the folder splunk_app_windows_infrastructure OR you can delete the entire folder “splunk_app_windows_infrastructure” .
A sample image is given below
(admin is an user, so it appears in $SPLUNK_HOME\etc\users)
ii) Remove the winfra-admin entry from splunk passwd file located in $SPLUNK_HOME\etc.
NOTE: IF you are unable to open the passwd file due to permission issues, then copy & paste it to a different location (ex- desktop) and edit it. Once done, you can replace the original passwd file in $SPLUNK_HOME\etc with the edited copy.
iii) Restart your splunk.
Now try to change your password, you must be able to do it this time !!
Happy Splunking !!
