topic Re: Prompt for Splunk user when configuring Universal Forwarder in Getting Data In

Prompt for Splunk user when configuring Universal Forwarder

Mike_McMurray — Wed, 16 Mar 2011 07:45:53 GMT

I've just upgraded to Splunk 4.2 and have installed and started the UF on a Linux box. But when I try to run,

./splunk add forward-server <myip>:9997

I get prompted for a Splunk username and password. I've tried my Splunk indexer username (trial version at the moment) and local user credentials, but am obviously missing the point. Do I need to create a Splunk user (./splunk add user ...) on this machine first? If so, does this need to match a local user that the daemon will use?

I have installed the Win32 UF to send to my indexer and that's working fine.

Seems like this should be obvious (and I'm feeling dumb) but I can't find anything in the Docs. Thanks.

Re: Prompt for Splunk user when configuring Universal Forwarder

Stephen_Sorkin — Wed, 16 Mar 2011 07:50:17 GMT

By default, the user there is admin/changeme, unless you've changed it.

Re: Prompt for Splunk user when configuring Universal Forwarder

Mike_McMurray — Wed, 16 Mar 2011 07:58:43 GMT

Ahh crap. My line of thinking was that this was prompting for credentials of the remote indexer and NOT the local splunk UF.
So, yes, the UF config is asking for the credentials of the local splunk install, which was the default.
Thanks

Re: Prompt for Splunk user when configuring Universal Forwarder

araitz — Wed, 16 Mar 2011 12:50:05 GMT

Change the password while you are at it:

./splunk edit user admin -password coolNewP455w3rdddd