topic Re: AWS Splunk Enterprise new EC2 instance login help in Security

AWS Splunk Enterprise new EC2 instance login help

bt2025 — Sun, 12 Oct 2025 06:14:16 GMT

NEED HELP: Not able to sign-in with default password

On 11OCT2025, I tried launching a brand new Splunk Enterprise v10.0.1 from AMI into AWS EC2.

The ASK: Is there a way for me to change the default password via SSH?

If my AWS EC instance ID = "i-1234567890abcdefg"

On the Splunk web-console "http://a.b.c.d:8000"

username=admin

Attempted these default passwords with NO success.

SPLUNK-1234567890abcdefg

SPLUNK-i-1234567890abcdefg

SPLUNK-$1234567890abcdefg$

SPLUNK-$i-1234567890abcdefg$

Re: AWS Splunk Enterprise new EC2 instance login help

kiran_panchavat — Sun, 12 Oct 2025 06:20:10 GMT

@bt2025 You can reset your admin password

Find the passwd file for your instance (/opt/splunk/etc/passwd) and rename it to passwd.bk

Create a file named user-seed.conf in your /opt/splunk/etc/system/local/ directory.

In the file add the following text:

[user_info]
PASSWORD = NEW_PASSWORD

In the place of "NEW_PASSWORD" insert the password you would like to use.

Restart Splunk Enterprise and use the new password to log into your instance from Splunk Web.

https://splunk.my.site.com/customer/s/article/Reset-admin-password-for-Splunk-Instance-via-REST-API

Re: AWS Splunk Enterprise new EC2 instance login help

thahir — Sun, 12 Oct 2025 09:24:37 GMT

@bt2025

Please follow the below steps to reset the Splunk login

1. Navigate to the Splunk configuration directory

<Splunk installation directory>/splunk/etc/

2. Back up the existing password file

mv passwd passwd.backup

3. Go to the local system configuration folder

<Splunk installation directory>/splunk/etc/system/local/

4. Create a new file named user-seed.conf

Add the following contents inside the file (replace <newpassword> with your desired password):

[user_info]
USERNAME = admin
PASSWORD = <newpassword>

5. Restart Splunk from the command line

<Splunk installation directory>/splunk/bin/splunk restart

Re: AWS Splunk Enterprise new EC2 instance login help

livehybrid — Sun, 12 Oct 2025 09:52:51 GMT

Hi @bt2025

The other replies give info on how to reset the password, but to confirm what the password *should* be...

The password for the user 'admin' should be SPLUNK-i-1234567890abcdefg

However - the error you are getting "Server Error" is not the same as password incorrect failure. Please can you use the developer console in your browser to see what the full response to the login request is using the Network tab?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: AWS Splunk Enterprise new EC2 instance login help

bt2025 — Mon, 13 Oct 2025 04:55:47 GMT

Thank you this workaround works!

Re: AWS Splunk Enterprise new EC2 instance login help

bt2025 — Mon, 13 Oct 2025 04:57:01 GMT

Thank you this workaround works!

Re: AWS Splunk Enterprise new EC2 instance login help

bt2025 — Mon, 13 Oct 2025 05:11:29 GMT

Thank you so very much!

Firstly, for dispelling the default AWS EC2 default password format of SPLUNK-$instanceID$.

Net, you are absolutely right that the "server error" was not due to an incorrect password login.

Just for background info for other community explorers: This EC2 was deployed in us-east-1 with c5.xlarge.

I took the path of the workarounds given by the other Splunk community contributor(s) but initially it did not work. Due time constraints (too late on Saturday night), I gave up for the night.

The next day (Sunday), I tried the workarounds again, BAM! Works!

Net-net, I reckoned there was a long delay between the EC2 instance is READY "3/3 checks passed" and when it was actually SplunkD ready.

Thus, if other community readers encounter the same problem, please let your (Splunk v10) EC2 instance sit and simmer for a while before pulling your hair out on why the default password does NOT work.

Again, cheers always and continue happy splunk'ing!