Migrating user configurations to 4.0.5
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Migrating user configurations to 4.0.5
If you see an error such as the following during upgrade:
Cannot automatically migrate user dir etc/users/_reserved/jrodman.2342413241241324315235 to etc/users/jrodman. Destination dir already exists
this issue applies to you. If you do not remember if these messages appeared, or if the migration was done by others, you can review the migration log in var/log/splunk/migration.log.<timestamp>
Background
In Splunk 4.0.5, users who log in with mixed case usernames are supported correctly. Users are now treated in a case-insensitive fashion. Thus logging into splunk as 'JRodman' or 'jrodman' is identical.
In Splunk 4.0 through 4.0.4, user names were treated differently. If a user logged into Splunk 4.0 through Splunk 4.0.4 as both 'JRodman' and 'jrodman', two user directories would be created, with two different sets of settings. There were various other problems as well with some settings not working, such as saved searches SPL-26335.
The 'JRodman' user settings were stored in etc/users/_reserved/jrodman.<hash>/ The mapping was stored in etc/users/users.ini
Behavior of migration
Users who always logged into Splunk the same way will have no problem with their data being automatically migrated. Users who logged into Splunk with multiple capitalizations of the same username may experience a lack of automatic migration.
Only the 'jrodman' settings will be available by default after updating to 4.0.5.
Splunk will only use settings in etc/users/<username> in 4.0.5 and later. Settings still in etc/users/_reserved/<username>.<hash> will not be used.
Resolving the situation
The resolution of user directories that are not migrated is to manually review the files in etc/users/_reserved/jrodman.2342343243242343 and in etc/users/jrodman to merge or select settings as appropriate.
Since various configuration components did not behave correctly for the user directories in _reserved, it's possible that the configuration will have become dirty (many attempts to create the same search over and over with slightly different names). In some cases it may be most time-effective to simply blank the user settings in some cases.
This documentation applies to the following versions of Splunk: 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.