This is the link you're looking for in Splunk 6.4.0:
Add the user on any Cluster node to
$SPLUNK_HOME/etc/passwd and it will be replicated in the cluster.
And here the pre Splunk 6.4.x solution:
Look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/AdduserstotheSHC#Use_Splunk_Enterprise_... and pay attention to this note:
There is one answer https://answers.splunk.com/answers/181506/how-to-create-and-share-usersroles-between-search.html where you can find one solution to replicate it using rsync between all the SHC nodes.
Hope this helps ...
Woah woah woah. I think those posts are for before 6.4. My understanding was the in 6.4 the local user accounts were replicated without issue.
(fair warning: I haven't check the links y'all posted just yet so apologies if I'm completely off).
I'll update this post with the details when I find them. I'm guessing its all in the docs.
Glad I jumped in here. See what @MuS posted? That's correct: http://docs.splunk.com/Documentation/Splunk/6.4.0/DistSearch/AdduserstotheSHC
Specifically, this is the bad boy you're looking for:
For Splunk Enterprise built-in authentication, you can use Splunk Web or the CLI to add users and map roles. Perform the operation on any one of the cluster members. The cluster then automatically distributes the changes to all members by replicating the $SPLUNK_HOME/etc/passwd file.
Yes, @SloshBurch [Splunk] I just used the wrong old link in the first post - corrected now! Thanks for pointing out this nice new feature!