How to copy saved searches/reports/dashboards from an existing user to a new one?

[seilemor]

Hello,

Because of some internal measures, we must change some settings within our Splunk installation. For example, we need a strong authentication which I'll provide with an Apache which will authenticate the user based on a client certificate and kerberos auth.

Within Splunk, I use for authentication the LDAP option. Currently, the username is only "user" and not "user@domain". Because of the configuration with the kerberos auth, I must change the usernames to "user@domain".

Now I've created a second LDAP strategy with the modified username value. These modification has the consequence that now each user is double; "user" and "user@domain".

Until now, I've had no problems - authentication with the old and the new user are working fine. The problems are the following:

1. Is it a good choice to use the FQDN in addition to the username? In the filesystem, the folders are also with the @ character. Is this maybe a problem for the OS/software!?
2. How can I copy the existing user configurations such as saved searches/reports/dashboards to the new user profiles? I've tried to copy the complete content of the user folder "user" to "user@domain". The curious thing is that not each configuration is visible in the new profile; for example, from 10 saved searches, only 6 are available. Within the savedsearches.conf in the filesystem, I can see the missing configurations. I've already restarted the splunk deamon and executed the refresh function ( https://.../de-DE/debug/refresh). I've also tried the solution from this thread (https://answers.splunk.com/answers/169872/how-to-copy-savedsearchesconf-from-one-user-to-ano.html). Sadly it has not solved my problem because the "vsid" attribute is not present in my conf file.

Has anyone a idea!?

Regards
seilemor

[Thienpask]

I wrote this script to migrate user preferences, save searches, and what nots from local user to SAML user. Modify the script to fit your needs. You will need to restart splunk service after move.

splunkUserDir="$SPLUNK_HOME/etc/users"
moveUser () {
oldUser=$1
newUser="$2@domainName"
if [ -d $splunkUserDir/$oldUser ]
then
if [ ! -d $splunkUserDir/$newUser ] ; then mkdir $splunkUserDir/$newUser; fi
mv -f $splunkUserDir/$oldUser/* $splunkUserDir/$newUser/
find $splunkUserDir/$newUser -type f -name local.meta -exec sed -i "s/$oldUser/$newUser/g" {} \;
chown -Rc splunk:splunk $splunkUserDir/$newUser
echo "*** $oldUser preferences and dashboard replicated to $newUser "
else
echo "* old user, $oldUser, preferences and dashbaoard not found. Nothing was done! ****"
fi
}

if [ "$#" -ne 2 ]; then
echo "Illegal number of parameters"
else
moveUser $1 $2
fi

[somesoni2 · Accepted solution]

Hello Seilemor,

1. I don't see any issue with using FQDN username. I've not seen any issues with OS (Windows and Linux) when this type of user naming convention is used.
2. There will be two things that you need to modify, in order to migrate a knowledge object from one user to another

..................a. Copy the content of user profile directory etc/users/user1 to etc/users/user2
..................b. Modify .meta files (local.meta) - replace owner = user1 with owner = user2

Restart splunk after the change.

[seilemor]

Hey somesoni2,

thanks for your answer. The problem was the owner attribute within the local.meta file. I've changed the attribute and now I can see all reports 🙂

Regards