【浅聊】 Splunk Deployer 对user 信息的推送过程

1: 背景：

  用户的有些dashboard/ report 私人的都是放在/opt/spunk/etc/users/xxx/local 下面的，如果想这部分的dashboard / report /alert 都做迁移的话，那么就要先送到deployer 上面：

2: 原理：

因为user 的这些配置信息都是在: /opt/spunk/etc/users/xxx/local 下面的，所以，也要放到deployer 的： /opt/spunk/etc/users/xxx/local/ 下面。

3: 实践：

When you migrate user configurations to an existing search head cluster, the deployer respects the values for attributes that already exist on the cluster. It does not overwrite values for any existing attributes within existing stanzas.

For example, say the cluster members have an existing file $SPLUNK_HOME/etc/users/admin/search/local/savedsearches.conf containing this stanza:

[my search]
search = index=_internal | head 1