How to migrate savedsearches.conf from one search head cluster to another?

[brent_weaver]

I need to migrate two savedsearches.conf files to a new search head cluster:

/opt/splunk/etc/apps/search/local/savedsearches.conf
/opt/splunk/etc/users/212059627/search/local/savedsearches.conf

How do I do this in a way that will propagate throughout the other nodes as well as maintain ownership in the new environment? The username in the new environment that will own these is different, so I assume these needs to be stored in their ../etc/users/dir??!? I know I can use the deployement server to deploy these but then they do not get the proper permissions. I think the key is to migrate /opt/splunk/etc/apps/search/local/savedsearches.conf because that seems to allow this all to be seen from the cluster.

Any help is much appreciated.

[badrinath_itrs · Accepted solution]

Hi,

Please follow below steps to push your changes.

1./opt/splunk/etc/apps/search/local/savedsearches.conf

Copy this file to a new/existing app on your Deployer ( $SPLUNK_HOME/etc/shcluster/apps) and push the change from Search Head Deployer to the members.

1. /opt/splunk/etc/users/212059627/search/local/savedsearches.conf

You can copy this file under the appropriate user ( $SPLUNK_HOME/etc/shcluster/users) folder on your deployer and push the change from Search Head Deployer.

For search head cluster, you should not be using deployment server to push changes to your search head members.

Refer below documentation for further details.
http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/PropagateSHCconfigurationchanges

[brent_weaver]

Thanks guys this worked!