Deployment Architecture

What is the best way to add users to the search head cluster?


We are running Splunk 6.3.3. Our search head cluster (4 search heads at the moment) is using SAML authentication.
We are looking for a way to add an user with Splunk authentication without adding it on each search head separately.

Any ideas will be appreciated!

0 Karma

Path Finder

There is no way in 6.3.3 to have the changes replicate. You'll need to run the splunk add user command on each search head.


@cdoebert, actually there is a way to replicate - if shared secret is the same between servers (in our case there is) we can copy $SPLUNK_HOME/etc/passwd file that has a new user created to other servers , restart splunk on servers with just copied file. Make sure to backup

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!