REST API password

[ccsfdave]

I set the darn thing over 3 years ago and it is not any of my usual passwords. Is there a way to recover the REST API password? I am talking about the one that defaults as "changeme"

Also if I can recover it, will anything break e.g. forwarders?

Thanks!

[jkat54 · Accepted solution]

You can revert to the default encrypted password in $splunk_home/etc/passwd .

Just install on a test server/laptop and copy the line that is for the admin user. Then the pass will be changeme again.

Nothing will break unless you have scripts that call the API. They'll need to be updated with the new password you set.

Also the rest api pass is the same as the web ui user/passes. Just making sure you know that.

[ccsfdave]

OH if the API pwd is the same as the UI, I know that but it keeps choking on some of the special characters in my password. Do I need to escape them?

[jkat54]

Yep

 'Password\!' 

For example maybe Google "which characters to escape with curl/whatever you're using"

[ccsfdave]

Sweet,

No need to change or recover, just needed the escape characters. I am good now!