how to centralized the splunk login account?

Path Finder

Dear Sir,

We will have two indexer servers for our account login to manage they account founctions, so how to centralized the splunk login account?

Tags (1)
0 Karma


You could deploy your $SPLUNK_HOME/etc/passwd. I've done this over multiple indexers/search heads and even over my forwarders.

Or more easier just scp your passwd file to your boxes.

0 Karma

Path Finder

Thanks for your comment, for the options 2, if I use openldap, seems splunk can't centralized manage the users account.

Actually, what I want is that two indexer servers can centralized manage the users account.

Looking forward to your reply, thanks.

0 Karma


More detail on your environment and what you are trying to accomplish would be helpful. However, the following may be helpful:

In general, you may wish to consult Set up user authentication in the Splunk docs.

The options are:

  1. Manually create an account with the same name and password on each indexer.
  2. Use LDAP Authentication with an external account store.
  3. Use a scripted authentication for RADIUS or to allow complete customization.
  4. Use an external authentication source and Splunk's support for single-sign-on.

Options (1) or (2) are usually the easiest to maintain for a small number of indexers. Option (2) is particularly recommended if Active Directory or another LDAP provider is available.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!