topic Re: Enable forward-server in Linux Universal Forwarder in Getting Data In

Enable forward-server in Linux Universal Forwarder

frejen — Fri, 17 Jun 2011 09:37:35 GMT

Hi,

I have some problems with running the following command.

$ splunk add forward-server host:port

It asks for username and password, i assume that the credentials should be the ones used when logging in to the Splunk WebUI. But authentication fails. I have also tried with the credentials for the local Splunk account. But still no luck.

When reading the Universal Deployment Manual I can not see any information about authentication. I have not added any SSL Cert, i guess this issue can be related to SSL communication between Forwarder and Reciever. But i just want to use the default certs.

I have tried running the command both as root and splunk user. But no luck at all.

Any ideas?

Re: Enable forward-server in Linux Universal Forwarder

sergemueller — Fri, 17 Jun 2011 09:49:02 GMT

there is a small hint in the universalforwader docu.(i think its a comment)

it is the default login:
admin/changeme

Re: Enable forward-server in Linux Universal Forwarder

frejen — Fri, 17 Jun 2011 09:50:50 GMT

Hi,

Thank you that did the trick! But the password for "admin" i use to login to WebUI has been changed is not "changeme". How can i change that password?

Frej

Re: Enable forward-server in Linux Universal Forwarder

sergemueller — Fri, 17 Jun 2011 10:02:56 GMT

http://splunk-base.splunk.com/answers/12638/prompt-for-splunk-user-when-configuring-universal-forwarder

search is your friend:)

./splunk edit user admin -password coolNewP455w3rdddd

Re: Enable forward-server in Linux Universal Forwarder

unwiresplunk — Tue, 30 Jul 2013 13:47:22 GMT

Is there a way to change the password without using the "-password " parameter on the CLI to avoid using a script to keep .bash_history clean ?

Re: Enable forward-server in Linux Universal Forwarder

lukejadamec — Tue, 30 Jul 2013 15:55:44 GMT

Yes, there is a way to change the password without using the -password parameter.

See this article from Splunk:
docs.splunk.com/Documentation/Splunk/5.0.3/Security/Deploysecurepasswordsacrossmultipleservers

Re: Enable forward-server in Linux Universal Forwarder

unwiresplunk — Wed, 31 Jul 2013 12:52:32 GMT

Thank you lukejadamec, that was outside my thinking box at the time of writing - the file is like a htpasswd file... I should have noticed that 🙂 Thanks