Installation

How to import a user account from one Splunk instance to another?

ameslet
Explorer

Hi,

I would like to import a user account from one Splunk instance to another one. Is it enough to copy the users directory in app/list/Splunk/etc?

Thanks for your advice,

Alex

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You also need to copy the entries in $SPLUNK_HONE/etc/passwd. Be sure to clone the roles first, though. This is only for local users.

View solution in original post

woodcock
Esteemed Legend

You also need to copy the entries in $SPLUNK_HONE/etc/passwd. Be sure to clone the roles first, though. This is only for local users.

ameslet
Explorer

Thanks for you answer, I didn't get it. What do you mean by clone the roles ?

0 Karma

woodcock
Esteemed Legend

Check the Settings -> Access Controls -> Roles and make sure that any of those assigned to the user that is being copied are setup before you copy. Otherwise the user behavior will probably not work correctly on the destination Search Head.

0 Karma

ameslet
Explorer

Okay, I get it now. I have checked for every user I want to import that the role alerady exists before copying it. Nevertheless, the users aren't recognized by the new instance. Do you know xaht I could do more to fix this issue ?

0 Karma

woodcock
Esteemed Legend

Sorry, you also need to copy the entry in $SPLUNK_HONE/etc/passwd.

0 Karma

ameslet
Explorer

Okay, it's working perfectly now. Thank you very much for your help.

0 Karma

saurabh_tek
Communicator

this works! Thanks

0 Karma

mdmaala
Communicator

How will I be able to clone the roles? I am checking this thread because I will transfer my splunk instance to a new account. Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...