https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83429#M2767 <P>Maybe I should've searched better, but hopefully the link to the doc is useful to you. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 03 Apr 2013 15:41:33 GMT echalex 2013-04-03T15:41:33Z https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83426#M2764 <P>Hi,</P> <P>I'm wondering how Splunk (4.3.x) deals with new roles created through the GUI. Since they're located in etc/system, I suppose you have to distribute any changes by yourself, or is there a way to automate this?</P> Wed, 03 Apr 2013 15:13:19 GMT https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83426#M2764 echalex 2013-04-03T15:13:19Z https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83427#M2765 <P>I'm in a similar situation, but on 5.0.1. I'd love to see the solution as well.</P> Wed, 03 Apr 2013 15:21:26 GMT https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83427#M2765 alacercogitatus 2013-04-03T15:21:26Z https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83428#M2766 <P>Answering my own question, this situation has been documented. <BR /> (<A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Howauthorizationworksindistributedsearches">5.0.2</A>, <A href="http://docs.splunk.com/Documentation/Splunk/4.3.5/Deploy/Howauthorizationworksindistributedsearches">4.3.5</A>)</P> Wed, 03 Apr 2013 15:39:40 GMT https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83428#M2766 echalex 2013-04-03T15:39:40Z https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83429#M2767 <P>Maybe I should've searched better, but hopefully the link to the doc is useful to you. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 03 Apr 2013 15:41:33 GMT https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83429#M2767 echalex 2013-04-03T15:41:33Z https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83430#M2768 <P>That is how we handle authorize.conf. We have the common (shareable) information in a "splunk_system" app and the server specific information in $SPLUNK_HOME/etc/system/local. We do this for all the $SPLUNK_HOME/etc/system/local config files.</P> Wed, 03 Apr 2013 18:20:25 GMT https://community.splunk.com/t5/Security/Search-head-pooling-and-authorize-conf/m-p/83430#M2768 rmorlen 2013-04-03T18:20:25Z