HTTP 400 error in DBConnect due to changing admin username

[L_Petch]

Hello all,

The Splunk default admin name has been changed and now I get the below error on Splunk DB connect. Please can someone let me know which conf file holds this info so I can change it to the new username?

Splunkd error: HTTP 400 -- User with name=admin does not exist

[L_Petch · Accepted solution]

Hi,

So this error was due to the Admin user being deleted and the owner being set to admin still. I managed to fix this by changing the owner but after talking to PS deleting Admin is a mistake as so many services rely on it that it has been changed back.

[etoombs]

Does your new admin account have the admin role associated? If not, did you look at the roles associated and make sure all of the db_connect items are allowed?