Security

How to copy users from indexer to search head+Private sharing permission stuff wouldn't work after being copied..

MarMoh
Path Finder

Hi All,
I have a physical box working as a search head/indexer, but I set up a vm and installed Splunk on it to use it as a dedicated search head and use the existing box as a dedicated indexer...I copied apps & users folders from C:\Program Files\Splunk\etc and also passwd file from etc folder... restarted the search head instance but just users with admin role showed up( there are 190 users in the indexer)...so this is my first question "how can I see all the users in the search head" and another problem is that all the searches ,views and field extraction (basically anything that has a sharing permission) with "Private" sharing permission in the indexer wouldn't show up in the search head.so second question is how to make the private stuff show up in the search head?
any help?

0 Karma

carmackd
Communicator

Do the same user role exist on the VM search head that exist on your indexer/search head? Check your splunkd log on the VM search head for unknown role errors.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!