topic Re: Restore Splunk user account in Splunk Enterprise

Restore Splunk user account

LogUx — Thu, 06 Jun 2024 12:34:29 GMT

Hello Splunkers!!

After resetting my admin password, the users' accounts are gone and they are not visible in the UI. How can I restore all those user login accounts?

In the above picture from the backend I can see the users. but from the UI no user account is visible.

Re: Restore Splunk user account

richgalloway — Thu, 06 Jun 2024 14:23:20 GMT

How did you reset the admin password?

Re: Restore Splunk user account

LogUx — Thu, 06 Jun 2024 15:16:11 GMT

@richgalloway Rename the passwrd file under /etc/system and change the password under user-seed.conf file for admin user.

Re: Restore Splunk user account

richgalloway — Thu, 06 Jun 2024 15:53:11 GMT

I thought that was how it was done. The user accounts are still in the renamed passwd file. Put it back (after transferring the admin password from the new passwd file), restart, and the accounts should be restored.

Re: Restore Splunk user account

LogUx — Thu, 06 Jun 2024 16:11:34 GMT

@richgalloway

I changed the file name twice while troubleshooting and now I think the original password file is lost.

Re: Restore Splunk user account

richgalloway — Thu, 06 Jun 2024 17:55:25 GMT

If that's the case then you'll have to restore the file from a backup.