- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I distribute user info across multiple search heads via deployment server ?
rakesh_498115
Motivator
12-30-2013
02:21 AM
Hi..
I have 4 SH's, out of which one is acting as a deployment server. The users created at deployment server should be passed to other search heads i.e other 3 SH's . How can I do that ?? Is there any specific configuration to push the users created in Splunk to other search heads ?? or do I need to manually copy the pwd file to every search head ??
Please help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yannK

Splunk Employee
12-30-2013
10:33 AM
No, the users are in $SPLUNK_HOME/etc/passwd, and are not replicated accros search-heads or search-head-pooling.
While roles are defined in authorize.conf that is replicated from SH to indexers only.
you could copy the password file, but the personal objects saved on a search-head will not be replicated to the others.
The workaround is to use :
- search-head polling (to have the users profiles centralized across search-head)
- and use a third party authentication (LDAP, AD, etc..) to centralize the login password.
