As the title suggests, I am trying to copy Splunk native user accounts from a standaslone SH to a search head cluster and I only need to migrate specific user accounts, for this, I am planning to copy the respective line from the /etc/passwd file of the standlone SH to the SHC.
However, after checking out this doc it appears if I copy the lines to the existing /etc/passwd file on a SHC member, it won't replicate it. I would have to push the file from the deployer. However, I am not exactly sure how should I do it from the deployer ?
https://docs.splunk.com/Documentation/Splunk/9.2.1/DistSearch/PropagateSHCconfigurationchanges
Regarding the etc/passwd changes, my guess would be "don't do it". I think the encryption of the passwords must be redone. Use the UI for password changes so it replicates across the cluster.