Manually Migrating User Configuration in 4.0.5

Identifying the problem

If you see an error such as the following, during upgrade

Cannot automatically migrate user dir etc/users/_reserved/jrodman.2342413241241324315235 to etc/users/jrodman. Destination dir already exists

this issue applies to you. If you do not remember if these messages appeared, or if the migration was done by others, you can review the migration log in var/log/splunk/migration.log.<timestamp>

Background

In Splunk 4.0.5, users who log in with mixed case usernames are supported correctly. Users are now treated in a case-insensitive fashion. Thus logging into splunk as 'JRodman' or 'jrodman' is identical.

In Splunk 4.0 through 4.0.4, usernames were treated differently. If a user logged into Splunk 4.0 through Splunk 4.0.4 as both 'JRodman' and 'jrodman', two user directories would be created, with two different sets of settings. There were various other problems as well with some settings not working, such as saved searches SPL-26335.

The 'JRodman' user settings were stored in etc/users/_reserved/jrodman.<hash>/ The mapping was stored in etc/users/users.ini

Behavior of migration

Users who always logged into Splunk the same way will have no problem with their data being automatically migrated. Users who logged into splunk with multiple capitalizations of the same username may experience a lack of automatic migration.

Only the 'jrodman' settings will be available by default after updating to 4.0.5.

Splunk will only use settings in etc/users/<username> in 4.0.5 and later. Settings still in etc/users/_reserved/<username>.<hash> will not be used.

Resolving the situation

The resolution of user directories that are not migrated is to manually review the files in etc/users/_reserved/jrodman.2342343243242343 and in etc/users/jrodman to merge or select settings as appropriate.

Since various configuration components did not behave correctly for the user directories in _reserved, it's possible that the configuration will have become dirty (many attempts to create the same search over and over with slightly different names). In some cases it may be most time-effective to simply blank the user settings in some cases.