Hello,
Because of some internal measures, we must change some settings within our Splunk installation. For example, we need a strong authentication which I'll provide with an Apache which will authenticate the user based on a client certificate and kerberos auth.
Within Splunk, I use for authentication the LDAP option. Currently, the username is only "user" and not "user@domain". Because of the configuration with the kerberos auth, I must change the usernames to "user@domain".
Now I've created a second LDAP strategy with the modified username value. These modification has the consequence that now each user is double; "user" and "user@domain".
Until now, I've had no problems - authentication with the old and the new user are working fine. The problems are the following:
https://.../de-DE/debug/refresh
). I've also tried the solution from this thread (https://answers.splunk.com/answers/169872/how-to-copy-savedsearchesconf-from-one-user-to-ano.html). Sadly it has not solved my problem because the "vsid" attribute is not present in my conf file.Has anyone a idea!?
Regards
seilemor
Hello Seilemor,
..................a. Copy the content of user profile directory etc/users/user1
to etc/users/user2
..................b. Modify .meta
files (local.meta) - replace owner = user1
with owner = user2
Restart splunk after the change.
I wrote this script to migrate user preferences, save searches, and what nots from local user to SAML user. Modify the script to fit your needs. You will need to restart splunk service after move.
splunkUserDir="$SPLUNK_HOME/etc/users"
moveUser () {
oldUser=$1
newUser="$2@domainName"
if [ -d $splunkUserDir/$oldUser ]
then
if [ ! -d $splunkUserDir/$newUser ] ; then mkdir $splunkUserDir/$newUser; fi
mv -f $splunkUserDir/$oldUser/* $splunkUserDir/$newUser/
find $splunkUserDir/$newUser -type f -name local.meta -exec sed -i "s/$oldUser/$newUser/g" {} \;
chown -Rc splunk:splunk $splunkUserDir/$newUser
echo "*** $oldUser preferences and dashboard replicated to $newUser "
else
echo "* old user, $oldUser, preferences and dashbaoard not found. Nothing was done! ****"
fi
}
if [ "$#" -ne 2 ]; then
echo "Illegal number of parameters"
else
moveUser $1 $2
fi
Hello Seilemor,
..................a. Copy the content of user profile directory etc/users/user1
to etc/users/user2
..................b. Modify .meta
files (local.meta) - replace owner = user1
with owner = user2
Restart splunk after the change.
Hey somesoni2,
thanks for your answer. The problem was the owner attribute within the local.meta file. I've changed the attribute and now I can see all reports 🙂
Regards