topic Re: Splunk Admin Password in Security

Splunk Admin Password

hsharry — Thu, 01 Mar 2018 09:56:49 GMT

I have renamed passwd.bkg to passwd and restart splunk but still not able to reset my password using admin and changeme

Re: Splunk Admin Password

493669 — Thu, 01 Mar 2018 12:48:25 GMT

Just rename passwd file with a .bak extension and restart

Re: Splunk Admin Password

hsharry — Thu, 01 Mar 2018 12:56:15 GMT

Have tried it and does not work

Re: Splunk Admin Password

gjanders — Sat, 03 Mar 2018 05:55:39 GMT

Have you restarted the Splunk service since making this change?

Re: Splunk Admin Password

p_gurav — Tue, 29 Sep 2020 18:18:01 GMT

To reset the admin password:

Stop splunk service
Move the $SPLUNK_HOME/etc/passwd file to $SPLUNK_HOME/etc/passwd.bak
Start Splunk. After the restart you should be able to login using the default login (admin/changeme).

Re: Splunk Admin Password

wrangler2x — Wed, 02 May 2018 23:28:22 GMT

If you are on Splunk 7.1 then the method of recovering from an "I forgot the password for admin" situation is different. Prior to 7.1 just the absence of $SPLUNK_HOME/etc/passwd caused Splunk to reset the password to changeme. But on 7.1 there is an additional step.

You need to save the $SPLUNK_HOME/etc/passwd file, removing the original.
You need to edit a file called $SPLUNK_HOME/etc/system/local/user-seed.conf (this will probably be a new file).
You need to add a stanza called [user_info] and specify the admin user and what password you wish to use.
Then restart Splunk. This will generate a new $SPLUNK_HOME/etc/passwd file.
If you had something other than vanilla in the passwd file (other lines, other admin users) you need to put them back into the new passwd file and restart Splunk again.

Sample $SPLUNK_HOME//etc/system/local/user-seed.conf file [user_info] stanza

[user_info]
USERNAME = admin
PASSWORD = password

      * Password must meet complexity requirements. [See the docs][1].

Re: Splunk Admin Password

furrowaw — Thu, 03 May 2018 02:42:28 GMT

If you have local access to the server, you can do this from commandline. Password must be at least 8 characters.

splunk cmd splunkd rest --noauth POST /services/admin/users/admin "password=YourPasswordHere"

Re: Splunk Admin Password

horsefez — Thu, 03 May 2018 07:14:24 GMT

this procedure is retarded...
thanks for clarifying it tho!

Re: Splunk Admin Password

nk-1 — Sat, 07 Jul 2018 03:40:17 GMT

I copied my Development Spunk v6.x passwd file to Splunk v7.1, and I managed to use the v6.x admin password to get back in to Splunk v7.
Is there any way to stop Splunk v7 from insisting on using the new password naming rules?

Re: Splunk Admin Password

emotz — Tue, 14 Aug 2018 13:30:16 GMT

This no longer is sufficient in Splunk 7.1 and forward. You get no users exist message when you try to login again. See additional posts for this to create user-seed.conf which is case sensitive

Re: Splunk Admin Password

sampathsilva — Mon, 27 Aug 2018 22:35:24 GMT

My situation was bit different. I was not able to login after installing version 7.1 lab. The steps here did work. Thanks.

Re: Splunk Admin Password

rashi83 — Wed, 03 Jul 2019 15:45:41 GMT

Hi,

How can I rename the admin account name for Splunk dev license. As it's dev license it allows single user to be created and now I want to change the name of this id.

Is there any way?

Re: Splunk Admin Password

altink — Tue, 16 Jun 2020 19:00:08 GMT

Hi

I have a Splunk 7.1, on which I am performing the steps as described, but I still cannot logon.

regards

Altin

Re: Splunk Admin Password

anwarmian — Mon, 17 Aug 2020 18:31:29 GMT

This method works in 7.1+. It worked for me.

Re: Splunk Admin Password

syap — Fri, 16 Oct 2020 08:58:56 GMT

Hi, I do not have programming knowledge.
And now I forgot my Splunk Enterprise password.
Can someone help to guide me through how to reset the password?
What exactly I need to do and the path I needed to input?
Thank you and really appreciate your help.