topic Re: user-seed.conf not working in Universal Forwarder in Getting Data In

user-seed.conf not working in Universal Forwarder

Stem — Fri, 27 Mar 2026 18:17:00 GMT

I have installed the UF(.v 10.2.1) on a Windows server using the cli command below. Splunk appears to install successfully and the user.seed.conf is copied to 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\user-seed.conf'. However, when I start Splunk the user-seed.conf file doesn't get deleted and any attempts to perform command line configurations result in 'Login Failed' errors. Any insight on what I'm missing/failing to do?

Install Command:

msiexec.exe /i C:\tmp\SplunkUniversalForwarder.msi AGREETOLICENSE=Yes LAUNCHSPLUNK=0 RECEIVING_INDEXER="192.168.10.10:9997" /qn

Re: user-seed.conf not working in Universal Forwarder

PickleRick — Fri, 27 Mar 2026 19:35:49 GMT

Check the splunkd.log but generally that's happening if either splunkd cannot access the file or it has syntax errors.

Re: user-seed.conf not working in Universal Forwarder

isoutamo — Fri, 27 Mar 2026 23:11:31 GMT

Or you have already etc/passwd on place with content.

Re: user-seed.conf not working in Universal Forwarder

kknairr — Sat, 28 Mar 2026 18:44:24 GMT

@Stem Most probably, the user-seed file is not being parsed, likely due to syntax, or permissions. You may review the Splunkd logs to figure out the issue.

Make sure to follow the below syntax for the user-seed.conf file. Any deviation (extra spaces, wrong section header) will cause Splunk to ignore it.

[user_info]
USERNAME = admin
PASSWORD = <yourpassword>

Confirm the Splunk service account has read access to the file. On Windows, run Splunk as Administrator during installation or startup.

Ref:

user-seed.conf | Platform (last updated 2026-01-13T21:03:58.807Z)

If this post addressed your question, you can:

Give it karma to show appreciation 👍
Mark it as the solution if it solved your issue ✔️
Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

Re: user-seed.conf not working in Universal Forwarder

Stem — Mon, 30 Mar 2026 19:17:43 GMT

This appears to be the resolution to my issue. Installing Splunk .v 10.2.1 with the 'LAUNCHSPLUNK=0 ' parameter still generates a passwd file during installation. Deleting the file before first start allows the user-seed.conf file to be read and deleted. Thanks to all for your help!