https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-savedsearches-conf-from-one-search-head-cluster/m-p/243937#M9174 <P>I need to migrate two savedsearches.conf files to a new search head cluster:</P> <P>/opt/splunk/etc/apps/search/local/savedsearches.conf<BR /> /opt/splunk/etc/users/212059627/search/local/savedsearches.conf</P> <P>How do I do this in a way that will propagate throughout the other nodes as well as maintain ownership in the new environment? The username in the new environment that will own these is different, so I assume these needs to be stored in their ../etc/users/dir??!? I know I can use the deployement server to deploy these but then they do not get the proper permissions. I think the key is to migrate /opt/splunk/etc/apps/search/local/savedsearches.conf because that seems to allow this all to be seen from the cluster.</P> <P>Any help is much appreciated.</P> Mon, 21 Nov 2016 21:00:49 GMT brent_weaver 2016-11-21T21:00:49Z https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-savedsearches-conf-from-one-search-head-cluster/m-p/243937#M9174 <P>I need to migrate two savedsearches.conf files to a new search head cluster:</P> <P>/opt/splunk/etc/apps/search/local/savedsearches.conf<BR /> /opt/splunk/etc/users/212059627/search/local/savedsearches.conf</P> <P>How do I do this in a way that will propagate throughout the other nodes as well as maintain ownership in the new environment? The username in the new environment that will own these is different, so I assume these needs to be stored in their ../etc/users/dir??!? I know I can use the deployement server to deploy these but then they do not get the proper permissions. I think the key is to migrate /opt/splunk/etc/apps/search/local/savedsearches.conf because that seems to allow this all to be seen from the cluster.</P> <P>Any help is much appreciated.</P> Mon, 21 Nov 2016 21:00:49 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-savedsearches-conf-from-one-search-head-cluster/m-p/243937#M9174 brent_weaver 2016-11-21T21:00:49Z https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-savedsearches-conf-from-one-search-head-cluster/m-p/243938#M9175 <P>Hi,</P> <P>Please follow below steps to push your changes.</P> <P>1./opt/splunk/etc/apps/search/local/savedsearches.conf</P> <P>Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.</P> <OL> <LI>/opt/splunk/etc/users/212059627/search/local/savedsearches.conf</LI> </OL> <P>You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.</P> <P>For search head cluster, you should not be using deployment server to push changes to your search head members.</P> <P>Refer below documentation for further details.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges">http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges</A> </P> Mon, 21 Nov 2016 22:08:15 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-savedsearches-conf-from-one-search-head-cluster/m-p/243938#M9175 badrinath_itrs 2016-11-21T22:08:15Z https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-savedsearches-conf-from-one-search-head-cluster/m-p/243939#M9176 <P>Thanks guys this worked!</P> Mon, 21 Nov 2016 22:13:04 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-savedsearches-conf-from-one-search-head-cluster/m-p/243939#M9176 brent_weaver 2016-11-21T22:13:04Z