topic Logging in in Splunk Enterprise

Logging in

br0wall — Mon, 12 May 2025 01:51:18 GMT

Trying to log into splunk, this is my first time putting it on my personal cpu. I have a business account through my job. when i try logging in my password will not work and it says the license is expired.

Re: Logging in

kiran_panchavat — Mon, 12 May 2025 03:26:42 GMT

@br0wall

The "license is expired" error typically occurs when:

You're using a Splunk Enterprise trial license, which expires after 60 days.
Your personal installation is not connected to your company's Splunk License Master, which manages valid licenses for business accounts.
There might be a mix-up between a trial license on your personal computer and your company's enterprise license.

If you want to remove those messages, you have two options:

1 - connect your instance to Splunk License Master from your company
2 - Purchase a license for your personal splunk box

Note: If you select the option 1, please carefully about the data your are sending to this instance, because all the data that you indexed in your personal box will count against the company license, and maybe you can reach the day capacity license.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks

Please read this document where you can have more details about how splunk is being licensing.

Since you have a business account through your job, your company likely has a valid Splunk license. The issue may arise because your local Splunk installation is using a default trial license instead of connecting to your company's License Master.

https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Invalid-username-or-password-Your-license-is/m-p/352690

NOTE:

As I said, Splunk Entrerprise Trial Licence is valid for 60 days , I would suggest do complete uninstalltion of splunk in local system and try to install again.

Link to download

https://www.splunk.com/en_us/download/splunk-enterprise.html

also you can monitor license usgae using

https://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutSplunksLicenseUsageReportView

Re: Logging in

livehybrid — Mon, 12 May 2025 06:54:23 GMT

Hi @br0wall

Is this a new insallation of Splunk on your device? Splunk provides a 60-day trial until you need to change it to the free version.

Is the instance on your own device connected to the license manager within your company, or is this a standalone instance?

If this is a development instance the you could look at applying for a developer license at https://dev.splunk.com/enterprise/dev_license/

Alternative you could completely remove and re-install Splunk, however depending on your usecase this might not be an option - Note, you would lose all existing data!

Nevertheless, this wont help you login. To reset the admin credentials for your Splunk instance follow the following instructions:

Find the passw file for your instance ($SPLUNK_HOME/etc/passwd) and rename it to passwd.bk Create a file named user-seed.conf in your $SPLUNK_HOME/etc/system/local/ directory. In the file add the following text: [user_info] PASSWORD = NEW_PASSWORD In the place of "NEW_PASSWORD" insert the password you would like to use. Start Splunk Enterprise and use the new password to log into your instance from Splunk Web.

Alternatively run the following:

$SPLUNK_HOME/bin/splunk cmd splunkd rest --noauth POST /services/admin/users/admin "password=<your password>"

For more info see https://docs.splunk.com/Documentation/Splunk/9.4.2/Security/Secureyouradminaccount#:~:text=ASCII%20character(s).-,Reset%20credentials,-If%20you%20lose

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Logging in

isoutamo — Mon, 12 May 2025 19:58:32 GMT

One comment. If I remember correctly, you must 1st remove/move your SPLUNK_HOME/etc/passwd file into another name. It if exists then that user-seed.conf didn't work.