topic Re: Add user in Splunk Enterprise

Add user

Emre1 — Mon, 15 Jan 2024 08:24:38 GMT

Hello,

I want to add a user to Splunk. I have a free license trial, and there is no "USER" oder "ADD USER" on my interface on splunk enterprise.
How else can i do that?

Re: Add user

Emre1 — Mon, 15 Jan 2024 08:31:10 GMT

I also tried it using the CMI, with the splunk add user -password -role -auth,
But I got a error there also.

"WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.
Requires license feature='Auth'"

How can I solve the problem?

Re: Add user

isoutamo — Mon, 15 Jan 2024 08:39:35 GMT

are you sure that you have Trial license not a Free license?

Splunk Free don't contains user license (Auth). There is only system user in internal use but no real user like admin.

Splunk Enterprise Trial license (valid for 60d after installation) have (at least one) user license (Auth option in lic file). Based on documentation, it have all all features allowed as normal license has, except it's just for single-instance, standalone version (e.g. no LM or any cluster features).

<features> <feature>Auth</feature> <feature>FwdData</feature> <feature>RcvData</feature> <feature>LocalSearch</feature> <feature>DistSearch</feature> <feature>RcvSearch</feature> <feature>ScheduledSearch</feature> <feature>Alerting</feature> <feature>DeployClient</feature> <feature>DeployServer</feature> <feature>SplunkWeb</feature> <feature>SigningProcessor</feature> <feature>SyslogOutputProcessor</feature> <feature>AllowDuplicateKeys</feature> </features>

See more about those licenses https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/TypesofSplunklicenses

r. Ismo

Re: Add user

PickleRick — Mon, 15 Jan 2024 08:50:29 GMT

As Ismo said - make sure which license you have.

By default Splunk installs with a trial license wich most of the features (apart from clustering related ones as far as I remember) which is valid for 60 days. After that time you have an option to either use your installation with a Splunk Free license (which is limited - doesn't contain ability to create multiple users, doesn't run scheduled searches, doesn't have forwarder management...) or provide a purchased commercial license/dev license/any other license.

So if you open your Splunk's web interface and it doesn't let you provide user/password to log you in and your web interface doesn't contain the whole "Users and authentication" section, you're most probably using the Free license, not the Trial one.

You can check which license you have by going to Settings -> System/Licensing