Security

How to copy users from indexer to search head+Private sharing permission stuff wouldn't work after being copied..

MarMoh
Path Finder

Hi All,
I have a physical box working as a search head/indexer, but I set up a vm and installed Splunk on it to use it as a dedicated search head and use the existing box as a dedicated indexer...I copied apps & users folders from C:\Program Files\Splunk\etc and also passwd file from etc folder... restarted the search head instance but just users with admin role showed up( there are 190 users in the indexer)...so this is my first question "how can I see all the users in the search head" and another problem is that all the searches ,views and field extraction (basically anything that has a sharing permission) with "Private" sharing permission in the indexer wouldn't show up in the search head.so second question is how to make the private stuff show up in the search head?
any help?

0 Karma

carmackd
Communicator

Do the same user role exist on the VM search head that exist on your indexer/search head? Check your splunkd log on the VM search head for unknown role errors.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...