How can I distribute user info across multiple search heads via deployment server ?

[rakesh_498115]

Hi..

I have 4 SH's, out of which one is acting as a deployment server. The users created at deployment server should be passed to other search heads i.e other 3 SH's . How can I do that ?? Is there any specific configuration to push the users created in Splunk to other search heads ?? or do I need to manually copy the pwd file to every search head ??

Please help

[yannK]

No, the users are in $SPLUNK_HOME/etc/passwd, and are not replicated accros search-heads or search-head-pooling.
While roles are defined in authorize.conf that is replicated from SH to indexers only.
you could copy the password file, but the personal objects saved on a search-head will not be replicated to the others.

The workaround is to use :

• search-head polling (to have the users profiles centralized across search-head)
• and use a third party authentication (LDAP, AD, etc..) to centralize the login password.