topic Re: Splunk password issue in Splunk Enterprise

Splunk password issue

uagraw01 — Mon, 17 Apr 2023 15:03:30 GMT

I am getting below error. Although I have changed my password & user name from user-seed.conf. But still it is showing below error.

But when I am login to UI, below are the error I am getting. Please help me how to fix this error.

Re: Splunk password issue

PickleRick — Mon, 17 Apr 2023 15:17:43 GMT

Did you restart your splunk instance?

Re: Splunk password issue

uagraw01 — Mon, 17 Apr 2023 15:18:49 GMT

@PickleRick Yes I have restarted

Re: Splunk password issue

PickleRick — Mon, 17 Apr 2023 15:22:18 GMT

# If the $SPLUNK_HOME/etc/passwd file is present,
the settings in this file (user-seed.conf) are not used

Re: Splunk password issue

uagraw01 — Mon, 17 Apr 2023 15:23:54 GMT

@PickleRick
No passwd file is generating after restarting of the Splunk.

Re: Splunk password issue

PickleRick — Mon, 17 Apr 2023 16:47:59 GMT

To be fully honest, if you already have a working installation, I would just edit etc/passwd manually and insert a hashed password there.

But if you don't have etc/passwd and it's not getting created from user-seed.conf - there must be something wrong. Check the splunkd.log for errors. Permission issues?

Re: Splunk password issue

isoutamo — Mon, 17 Apr 2023 16:57:19 GMT

As @PickleRick said you cannot have .../<SPLUNK_HOME>/etc/passwd file. If you have then you could use e.g.

Create admin credentials for automated installations with the 'hash-passwd' CLI command

to generate hashed password and add/change it into passwd file as already proposed.

r. Ismo

Re: Splunk password issue

uagraw01 — Mon, 17 Apr 2023 17:01:40 GMT

@PickleRick & @isoutamo It has been fixed. I was used to save the seed file as user-seed.conf. So when I restarted the Splunk it saved as user-seed.conf.conf. So I corrected and saved the file only as user-seed and gives the results as user-seed.conf and generated the passwd file also.

Re: Splunk password issue

woodcock — Mon, 17 Apr 2023 18:01:53 GMT

If no users exist that means that the $SPLUNK_HOME/etc/passwd file is missing. To create a new admin user, you can use user-seed.conf and it is very easy. Just double check your steps here:
https://docs.splunk.com/Documentation/Splunk/latest/Security/Secureyouradminaccount