Hello,
We were on single search head with lot of users and all of them have a lot of items saved under app context and search context. Some are private and some are global on both contexts.
I have copied $SPLUNK_HOME/etc/apps
(excluding search app and any other that exist on new search heads) and $SPLUNK_HOME/etc/users
from old search head to new search heads
Now some users' few saved items are missing (only Items that are saved under search context and Global are missing)
Any idea where those are stored, so I can move them over to new search heads?
Thanks,
Simon Mandy
Just ran into this today. The issue appears to be that content saved prior to migration is not fully recognized by clustering. (Which makes sense. It wasn't created in the cluster, so it's not fully aware of it) So the trick is to get it to create the appropriate clustering metadata. Thankfully, this is very easy:
Edit the item and save it. You don't even have to actually change anything. Just click Edit > Edit Description
and then click Save
on the popup. Then you should be able to modify the permissions.