Archive

Problem logging into splunk

Communicator

Hi,

I have been using the same credential to login to my Splunk, but all of a sudden it stops working this afternoon. The log shows the following error. I know my password is correct because it's my AD account and I use the same pwd to login to my computer. How can I troubleshoot this login problem?

Thanks.

2013-04-03 14:52:55,190 ERROR   [515ca4b6f952fec88] account:216 - user=xxx action=login status=failure reason=user-initiated useragent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; InfoPath.3)" clientip=xx.xx.x.xxx
Tags (1)

Path Finder

This is only affecting AD users

0 Karma

Communicator

Are you using LDAP to authenticate to AD with Splunk??

0 Karma

Communicator

If it is Splunk, yu can change the password here "$SPLUNKHOME/etc/passwd" Restart splunk and login with the Splunk default password

0 Karma

Communicator

Are you using Splunk and or LDAP to authenticate?

0 Karma

Communicator

Did you configure LDAP roles in Splunk for authentications? If yes, did you use LDAP search method or another utility to verify the LDAP attributes in configuring the "LDAP connection settings"
For example did you verify The Group base DN? Exaple
"OU=Security Groups - AIS,DC=ad,DC=it,DC=yourdc,DC=ext

0 Karma

Path Finder

Yes! I see the issue with AD users.
the search-heads have same error as in original question. and it is not a single server that has an issue.
This search 'index=_* "action=login status=failure" | stats count by user reason date_month date_mday date_wday date_hour host' sorts it out and I can see different users and different hosts with the error - all intermittent.

0 Karma

Path Finder

We have the same issue - did you find anything on this? thanks

0 Karma

Communicator

That only has a list of the accounts created in Splunk. Not AD accounts. Other people from same AD group don't have any problem logging in.

0 Karma

Communicator

Hey lain179,
I am not sure how splunk works with DA, but have you had a look at the passwd file that holds default user details in:
$SPLUNKHOME/etc/passwd
Might be somewhere to start.
Regards Vince

0 Karma