topic How do I reset only admin password? in Security

How do I reset only admin password?

spl109 — Mon, 01 Oct 2018 05:35:01 GMT

The splunk version is 6.6.3.

I have two user accounts. admin and test_admin.

When the admin password is reset, the test_admin account is deleted.

Question) Can I reset only the admin password?

Re: How do I reset only admin password?

iamarkaprabha — Tue, 29 Sep 2020 21:29:29 GMT

Hi ,

You can try resetting the admin password as per the guideline of below post
https://answers.splunk.com/answers/834/how-to-reset-the-admin-password.html

How to do this in 7.1 + :

Stop Splunk Enterprise
Find the passw file for your instance ($SPLUNK_HOME/etc/passwd) and rename it to passwd.bk
Create a file named user-seed.conf in your $SPLUNK_HOME/etc/system/local/ directory.
In the file add the following text:

[user_info]
PASSWORD = NEW_PASSWORD

In the place of "NEW_PASSWORD" insert the password you would like to use.
Start Splunk Enterprise and use the new password to log into your instance from Splunk Web.
If you previously created other users and know their login details, copy and paste their credentials from the passwbk file into the passwd file and restart Splunk.

Versions prior to 7.1 :

Stop Splunk Enterprise
Find the passw file for your instance ($SPLUNK_HOME/etc/passw) and rename it to passw.bk
Start Splunk Enterprise and login to your instance from Splunk Web using the default credentials of admin/changeme.
You will be asked to enter a new password for your admin account.
If you previously created other users and know their login details, copy and paste their credentials from the passw.bk file into the passwd file and restart Splunk.

Re: How do I reset only admin password?

spl109 — Thu, 11 Oct 2018 12:26:50 GMT

Thank you for answer.

But
If you do this the test_admin account will be deleted.

I want to delete only the password for the admin account.

Re: How do I reset only admin password?

iamarkaprabha — Thu, 11 Oct 2018 15:42:24 GMT

splunk edit user admin -password newPassowrd  -auth admin:changeme

Re: How do I reset only admin password?

iamarkaprabha — Thu, 11 Oct 2018 15:43:19 GMT

i believe you can edit for admin also , didn't try for test_admin , i have to check