Where do I add local accounts on a Splunk 6.4 Search Head Cluster?

[a212830]

Hi,

If I need to add a local account on a Splunk 6.4 Search Head Cluster, where is it done, and does it replicate?

[sloshburch]

Woah woah woah. I think those posts are for before 6.4. My understanding was the in 6.4 the local user accounts were replicated without issue.

(fair warning: I haven't check the links y'all posted just yet so apologies if I'm completely off).

I'll update this post with the details when I find them. I'm guessing its all in the docs.

[sloshburch]

Glad I jumped in here. See what @MuS posted? That's correct: http://docs.splunk.com/Documentation/Splunk/6.4.0/DistSearch/AdduserstotheSHC

Specifically, this is the bad boy you're looking for:

For Splunk Enterprise built-in authentication, you can use Splunk Web or the CLI to add users and map roles. Perform the operation on any one of the cluster members. The cluster then automatically distributes the changes to all members by replicating the $SPLUNK_HOME/etc/passwd file.

[a212830]

Another reason to use 6.4. Awesome.

[MuS]

Yes, @SloshBurch [Splunk] I just used the wrong old link in the first post - corrected now! Thanks for pointing out this nice new feature!

[MuS]

Hi a212830,

UPDATE:

This is the link you're looking for in Splunk 6.4.0:

http://docs.splunk.com/Documentation/Splunk/6.4.0/DistSearch/AdduserstotheSHC

Add the user on any Cluster node to $SPLUNK_HOME/etc/passwd and it will be replicated in the cluster.

And here the pre Splunk 6.4.x solution:
Look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/AdduserstotheSHC#Use_Splunk_Enterprise_... and pay attention to this note:

1. Create a script that adds each user through the splunk add user CLI command.
2. Run the script on each cluster member.

There is one answer https://answers.splunk.com/answers/181506/how-to-create-and-share-usersroles-between-search.html where you can find one solution to replicate it using rsync between all the SHC nodes.

Hope this helps ...

cheers, MuS

[MuS]

and here is the correct docs link http://docs.splunk.com/Documentation/Splunk/6.4.0/DistSearch/AdduserstotheSHC 😉