topic Re: Installing Splunk with existing splunk.secret in Installation

Installing Splunk with existing splunk.secret

matthewssa — Fri, 14 Apr 2023 19:49:12 GMT

Hello!

My situation is I'm doing a new installation of Splunk on a windows instance with an existing splunk.secret.

Question: Is there a command line flag to pass the splunk.secret during the initial installation?

My process in the past was to install Splunk without launching in order to prevent passwords from being generated. Then copy the splunk.secret over and start Splunk. It has been a while though and I think something changed, because Splunk writes a password to server.conf even if it isn't started for the first time. Now I have to remove the password with another command before starting it.

Re: Installing Splunk with existing splunk.secret

woodcock — Sun, 16 Apr 2023 20:49:59 GMT

Install Splunk the way that you plan to. Start Splunk. See what the pat is where it creates the splunk.secret file. Stop Splunk. Remove EVERYTHING. Reinstall Splunk. BEFORE YOU START SPLUNK, drop the splunk.secret file. Start Splunk.

Re: Installing Splunk with existing splunk.secret

matthewssa — Fri, 29 Dec 2023 00:21:45 GMT

This was a writeup that I did for this

Backup Splunk

Stop and Backup the entire Splunk folder if able.

/opt/splunk/bin/splunk stop

tar -zcvf splunk_pre_secret.tar.gz /opt/splunk/etc

Find encrypted passwords

find /opt/splunk/etc -name '*.conf' -exec grep -inH '\$[0-9]\$' {} \;

Record the context (file location, stanza, parameter)
Can decrypt the hashed passwords with the following

/opt/splunk/bin/splunk show-decrypted --value 'PASSWORDHASH'

Updating the splunk.secret

Copy the splunk.secret file from 192.168.70.2 to /opt/splunk/etc/auth/splunk.secret on the target system.

cp /home/dapslunk/splunk.secret /opt/splunk/etc/auth/splunk.secret

Ensure the permissions are correct 400

ll /opt/splunk/etc/auth/splunk.secret

Update all of the password sections

Use the following to find any missed passwords that have not been corrected.

find /opt/splunk/etc -name '*.conf' -exec grep -inH '\$[0-9]\$' {} \;

Restart Splunk

/opt/splunk/bin/splunk restart

Verify

Access to Splunk GUI
If any splunk commands that require authentication work
Connection to license master /cluster/ deployment server
If any inputs have data coming in
If LDAP authentication works
If all passwords are encrypted. Use the command from before.