Dashboards & Visualizations

Do user accounts and and dashboards get replicated in a 6.4.1 search head cluster?

a212830
Champion

Hi,

I am using a search head cluster on 6.4.1. I have a customer who created a dashboard, but for some reason, can't modify the permissions. (Different issue). When I investigated and logged into one of the search heads in that cluster, his account was not there. Are these immediately created, or only created when the individual actually logs into that server (we are using a load-balancer across 8 servers).

0 Karma

sowings
Splunk Employee
Splunk Employee

In modern (6.5+) versions of Splunk, local users (via the $SPLUNK_HOME/etc/passwd) file are synced between SHC members. When the new user is created, the user directory for the user ($SPLUNK_HOME/etc/users). This will permit the user's dashboard to replicate (it would live in $SPLUNK_HOME/etc/users/<app>/local/data/ui/views/<dashboard_name>.xml).

If you're seeing other behavior, it might be that 6.4 didn't (yet) support that.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

They should get replicated in other SHC members, as long as user is creating Splunk object via SPlunk Web, CLI or REST Api Endpoints.

0 Karma

pradeepkumarg
Influencer

What is the authentication method you are using? Is it LDAP or Local? local accounts are not replicated.

0 Karma

a212830
Champion

ldap. And I thought that I read in 6.4, local accounts are replicated.

0 Karma

pradeepkumarg
Influencer

Sorry, I take that back. Overlooked.. 6.4.. not there yet 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...