https://community.splunk.com/t5/Security/ERROR-AuthenticationManagerSplunk-Login-failed-Incorrect-login/m-p/236923#M14850 <P>Hi,<BR /> We noticed the disk space is crossing the threshold &gt;85% for the /opt/splunk mount point in one of our Dev Splunk AWS instance.On checking we are getting multiple error entries in splunkd.log for authentication failure as below. <BR /> We did try to reset the admin password to check if it resolves as per <A href="https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html">https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html</A> but it did not help. </P> <P>Please let us know what is the reason for the issue.<BR /> 08-22-2016 09:37:21.345 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin <BR /> 08-22-2016 09:37:21.397 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin </P> <P>Error entries in audit log <BR /> 08-22-2016 09:52:33.442 -0400 INFO AuditLogger - Audit:[timestamp=08-22-2016 09:52:33.442, id=22436721, user=admin, action=login attempt, info=failed][CVflHg3ekijQ+pPJxiiEPzHYxYkf6URGn8U7moMrgcezqbmJYnZjkFtn/KS4sIfb5Di91lblaZlmTaymQj4ey21AhyUUOR5t7Vyr81wcovG1vLSUN0OWLu3uuHn1oUFNysW9u29gMa0dMIzQ7Apv+gjL00GtMWX6Rr9WW46lhDc</P> <P>Please let me know if there is anyway to resolve this.</P> <P>Thanks,<BR /> Soumya</P> Wed, 24 Aug 2016 10:36:50 GMT sbhat13 2016-08-24T10:36:50Z https://community.splunk.com/t5/Security/ERROR-AuthenticationManagerSplunk-Login-failed-Incorrect-login/m-p/236923#M14850 <P>Hi,<BR /> We noticed the disk space is crossing the threshold &gt;85% for the /opt/splunk mount point in one of our Dev Splunk AWS instance.On checking we are getting multiple error entries in splunkd.log for authentication failure as below. <BR /> We did try to reset the admin password to check if it resolves as per <A href="https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html">https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html</A> but it did not help. </P> <P>Please let us know what is the reason for the issue.<BR /> 08-22-2016 09:37:21.345 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin <BR /> 08-22-2016 09:37:21.397 -0400 ERROR AuthenticationManagerSplunk - Login failed. Incorrect login for user: admin </P> <P>Error entries in audit log <BR /> 08-22-2016 09:52:33.442 -0400 INFO AuditLogger - Audit:[timestamp=08-22-2016 09:52:33.442, id=22436721, user=admin, action=login attempt, info=failed][CVflHg3ekijQ+pPJxiiEPzHYxYkf6URGn8U7moMrgcezqbmJYnZjkFtn/KS4sIfb5Di91lblaZlmTaymQj4ey21AhyUUOR5t7Vyr81wcovG1vLSUN0OWLu3uuHn1oUFNysW9u29gMa0dMIzQ7Apv+gjL00GtMWX6Rr9WW46lhDc</P> <P>Please let me know if there is anyway to resolve this.</P> <P>Thanks,<BR /> Soumya</P> Wed, 24 Aug 2016 10:36:50 GMT https://community.splunk.com/t5/Security/ERROR-AuthenticationManagerSplunk-Login-failed-Incorrect-login/m-p/236923#M14850 sbhat13 2016-08-24T10:36:50Z https://community.splunk.com/t5/Security/ERROR-AuthenticationManagerSplunk-Login-failed-Incorrect-login/m-p/236924#M14851 <P>I've got the same issue. It not admin password from Splunk server. Login admin and password is default by client one.</P> <P>I just used command<BR /> ./splunk add forward-server :9997</P> <P>Splunk username: <STRONG>admin</STRONG><BR /> Password: <STRONG>changeme</STRONG><BR /> Added forwarding to: xx.xx.xx.xxx:9997.</P> <P>It works!</P> Thu, 23 Mar 2017 21:32:09 GMT https://community.splunk.com/t5/Security/ERROR-AuthenticationManagerSplunk-Login-failed-Incorrect-login/m-p/236924#M14851 adilsonbna 2017-03-23T21:32:09Z