Hi All,
I have a physical box working as a search head/indexer, but I set up a vm and installed Splunk on it to use it as a dedicated search head and use the existing box as a dedicated indexer...I copied apps & users folders from C:\Program Files\Splunk\etc and also passwd file from etc folder... restarted the search head instance but just users with admin role showed up( there are 190 users in the indexer)...so this is my first question "how can I see all the users in the search head" and another problem is that all the searches ,views and field extraction (basically anything that has a sharing permission) with "Private" sharing permission in the indexer wouldn't show up in the search head.so second question is how to make the private stuff show up in the search head?
any help?
