Security

How to copy users from indexer to search head+Private sharing permission stuff wouldn't work after being copied..

MarMoh
Path Finder

Hi All,
I have a physical box working as a search head/indexer, but I set up a vm and installed Splunk on it to use it as a dedicated search head and use the existing box as a dedicated indexer...I copied apps & users folders from C:\Program Files\Splunk\etc and also passwd file from etc folder... restarted the search head instance but just users with admin role showed up( there are 190 users in the indexer)...so this is my first question "how can I see all the users in the search head" and another problem is that all the searches ,views and field extraction (basically anything that has a sharing permission) with "Private" sharing permission in the indexer wouldn't show up in the search head.so second question is how to make the private stuff show up in the search head?
any help?

0 Karma

carmackd
Communicator

Do the same user role exist on the VM search head that exist on your indexer/search head? Check your splunkd log on the VM search head for unknown role errors.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...