I have 4 SH's, out of which one is acting as a deployment server. The users created at deployment server should be passed to other search heads i.e other 3 SH's . How can I do that ?? Is there any specific configuration to push the users created in Splunk to other search heads ?? or do I need to manually copy the pwd file to every search head ??
No, the users are in $SPLUNK_HOME/etc/passwd, and are not replicated accros search-heads or search-head-pooling.
While roles are defined in authorize.conf that is replicated from SH to indexers only.
you could copy the password file, but the personal objects saved on a search-head will not be replicated to the others.
The workaround is to use :
search-head polling (to have the users profiles centralized across search-head)
and use a third party authentication (LDAP, AD, etc..) to centralize the login password.