topic Restore Admin Roles in Splunk After Accidental Deletion in Splunk Dev

Restore Admin Roles in Splunk After Accidental Deletion

sanjai — Thu, 08 Aug 2024 11:42:32 GMT

Hi Splunker,

I am currently working with REST API calls for user management in Splunk. While attempting to add additional roles to the default admin account, I accidentally removed the admin role from this account. Unfortunately, I do not have any other user accounts with admin privileges.

At present, I only have a single user account with the "User" role and cannot create a new user with "Admin" privileges.

Could you please advise on how to restore the deleted roles to the existing user account or suggest any alternative solutions?

Re: Restore Admin Roles in Splunk After Accidental Deletion

richgalloway — Thu, 08 Aug 2024 13:44:49 GMT

Restore the $SPLUNK_HOME/etc/system/local/authorize.conf file from your most recent backup and restart Splunk.

Re: Restore Admin Roles in Splunk After Accidental Deletion

isoutamo — Thu, 08 Aug 2024 16:37:36 GMT

And if you haven’t backups (you really should), just add role admin to your admin user into authorize.conf file with any text editor. See authorize.conf specs how it should do.

Re: Restore Admin Roles in Splunk After Accidental Deletion

sanjai — Fri, 09 Aug 2024 05:42:55 GMT

Thanks @richgalloway and @isoutamo for your time , it worked 🙂🙌