How to import a user account from one Splunk instance to another?

[ameslet]

Hi,

I would like to import a user account from one Splunk instance to another one. Is it enough to copy the users directory in app/list/Splunk/etc?

Thanks for your advice,

Alex

[woodcock · Accepted solution]

You also need to copy the entries in $SPLUNK_HONE/etc/passwd. Be sure to clone the roles first, though. This is only for local users.

[ameslet]

Thanks for you answer, I didn't get it. What do you mean by clone the roles ?

[woodcock]

Check the Settings -> Access Controls -> Roles and make sure that any of those assigned to the user that is being copied are setup before you copy. Otherwise the user behavior will probably not work correctly on the destination Search Head.

[ameslet]

Okay, I get it now. I have checked for every user I want to import that the role alerady exists before copying it. Nevertheless, the users aren't recognized by the new instance. Do you know xaht I could do more to fix this issue ?

[woodcock]

Sorry, you also need to copy the entry in $SPLUNK_HONE/etc/passwd.

[ameslet]

Okay, it's working perfectly now. Thank you very much for your help.

[saurabh_tek]

this works! Thanks

[mdmaala]

How will I be able to clone the roles? I am checking this thread because I will transfer my splunk instance to a new account. Thank you so much!