We're still using a Splunk 4.0 instance and want to upgrade to Splunk 5 (or even 6).
Now the question is how users can be migrated between those two versions?
I've tried the
splunk export userdata
splunk import userdata
commands.
The users are created in passwd but a login isn't possible ("wrong password") in the new Splunk. I've read that they way how Splunk hashes/salts passwords has been changed between Splunk 4.0 and 5 and it seems that this not taken into account when importing users from an old instance? Also the user folders with their custom configurations are not migrated.
Well, as I'm writing this down and thinking about it I notice that if it's actually true that the hashing algorithm has changed of course Splunk cannot migrate the passwords. Does this really mean all users have to be manually recreated?
... View more