thought I created a user, but it's not there. then creating it, the message Cannot create user that already exists pops up... where is it?
Internal
It is in the passwd file, but no special characters.
no hits in splunkd.log
Was able to fix it tho...removed it via the cli.. then was able to re-add it with the GUI
./splunk remove user "user"
Nice! - Please accept your own answer so others can see how you fixed it!
in linux shell run this command (replace "username" with your "lost" username):
grep "username" $SPLUNK_HOME/var/log/splunk/splunkd.log
How are you creating the user? UI? Do you've access to file system?
Adding thru the UI.. And yes-- have access to the linux subsystem