The user roles are stored in Authorize.conf file. If you've any custom role created, then they should be available in
$SPLUNK_HOME/etc/apps/ folder. Just copy the authorize.conf and restart the Splunk instance. More details here.
Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.
Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.
I found it. User's roles are stored in
$SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances.
Follow these instructions (and the info in comments) if you have to sync users and roles for the first time.
Later, you have to sync only:
passed file is for local authentication only and not Roles and Privileges.
Connection between roles and users are stored in that file. Please check.
authorize.conf does only contains roles, not connection between users and roles.