topic Re: How can I change the password without knowing the default or entered password for the forwarder? in Getting Data In

How can I change the password without knowing the default or entered password for the forwarder?

shawno — Thu, 22 Feb 2018 02:13:14 GMT

/opt/splunkforwarder/bin/splunk edit user admin -password $NEWPASSWORD

This doesn't work - how can I change the password without knowing the default or entered password for the forwarder?

Re: How can I change the password without knowing the default or entered password for the forwarder?

ansif — Tue, 29 Sep 2020 18:09:15 GMT

Try below steps:

Move the $SPLUNK_HOME/etc/passwd file
to $SPLUNK_HOME/etc/passwd.bak
Restart Splunk. After the restart you
should be able to login using the
default login (admin/changeme).

Re: How can I change the password without knowing the default or entered password for the forwarder?

cmoyanof — Fri, 22 Jun 2018 19:43:05 GMT

Hello,

May be will be useful for you to copy the bold text below into another admin user with a known password /opt/splunkforwarder/etc/passwd

:admin:$6$zGmwWFy17AEdVhjN$9YkUUBa4LM.Eds96Qs.DtjPOjorXVT57dasdasdasdaca.hxJ75.mmsrYNLmSXcVqu3gHbdBRJXtXv/ceBm1::Administrator:admin:changeme@example.com:::32533

Restart Splunk. After the restart you should be able to login using the previous splunkforwarder