Spread our blog

In handler ‘users’: Could not get info for role that does not exist: winfra-admin

The above splunk error can be encountered when changing the password for users with the winfra-admin role, after the uninstallation of splunk app for windows infrastructure.


To fix this error,

i) Find and delete residual files (if any) related to splunk app for windows infrastructure, can be found in $SPLUNK_HOME\etc\users\<user_name>, $SPLUNK_HOME\etc\apps located under the folder splunk_app_windows_infrastructure OR you can delete the entire foldersplunk_app_windows_infrastructure” .

A sample image is given below 
(admin is an user, so it appears in $SPLUNK_HOME\etc\users)


ii) Remove the winfra-admin entry from splunk passwd file located in $SPLUNK_HOME\etc.

NOTE: IF you are unable to open the passwd file due to permission issues, then copy & paste it to a different location (ex- desktop) and edit it. Once done, you can replace the original passwd file in $SPLUNK_HOME\etc with the edited copy.  

Screenshot (7)

iii) Restart your splunk.

Now try to change your password, you must be able to do it this time !!

Happy Splunking !!


What’s your Reaction?

Spread our blog
You can also know about :  The hard fd limit is lower than the recommended value
Previous articleUsage of Splunk EVAL Function : MVJOIN
Next articleUsage of Splunk EVAL Function : MVAPPEND
Passionate content developer dedicated to producing result-oriented content, a specialist in technical and marketing niche writing!! Splunk Geek is a professional content writer with 6 years of experience and has been working for businesses of all types and sizes. It believes in offering insightful, educational, and valuable content and it's work reflects that.


Please enter your comment!
Please enter your name here