Deployment Architecture

After migrating from a single search head to search head clustering, why have some user saved items under search context and global gone missing?

sim_tcr
Communicator

Hello,

We were on single search head with lot of users and all of them have a lot of items saved under app context and search context. Some are private and some are global on both contexts.

I have copied $SPLUNK_HOME/etc/apps (excluding search app and any other that exist on new search heads) and $SPLUNK_HOME/etc/users from old search head to new search heads

Now some users' few saved items are missing (only Items that are saved under search context and Global are missing)

Any idea where those are stored, so I can move them over to new search heads?

Thanks,
Simon Mandy

0 Karma
1 Solution

emiller42
Motivator

Just ran into this today. The issue appears to be that content saved prior to migration is not fully recognized by clustering. (Which makes sense. It wasn't created in the cluster, so it's not fully aware of it) So the trick is to get it to create the appropriate clustering metadata. Thankfully, this is very easy:

Edit the item and save it. You don't even have to actually change anything. Just click Edit > Edit Description and then click Save on the popup. Then you should be able to modify the permissions.

View solution in original post

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...