Security

How to copy users from indexer to search head+Private sharing permission stuff wouldn't work after being copied..

MarMoh
Path Finder

Hi All,
I have a physical box working as a search head/indexer, but I set up a vm and installed Splunk on it to use it as a dedicated search head and use the existing box as a dedicated indexer...I copied apps & users folders from C:\Program Files\Splunk\etc and also passwd file from etc folder... restarted the search head instance but just users with admin role showed up( there are 190 users in the indexer)...so this is my first question "how can I see all the users in the search head" and another problem is that all the searches ,views and field extraction (basically anything that has a sharing permission) with "Private" sharing permission in the indexer wouldn't show up in the search head.so second question is how to make the private stuff show up in the search head?
any help?

0 Karma

carmackd
Communicator

Do the same user role exist on the VM search head that exist on your indexer/search head? Check your splunkd log on the VM search head for unknown role errors.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...