Security

Splunk Enterprise Login

dannyze
Explorer

Hello all,

I am having problems logging into Enterprise. I've tried my username and password, admin and changeme after moving the opt/splunk/etc/ passwd file and renaming it. Still won't work. If there's any better way to reset to allow login, i'd appreciate it. It was working just fine yesterday.

Thank You

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Did you rename the right passwd file? Is Splunk installed somewhere else?

If you delete or rename the splunk_home/etc/passwd file and restart, it makes the admin password changeme everytime.

The only explanation is if you didn't rename the right file or some symbolic link exists.

0 Karma

dannyze
Explorer

jkat54
I believe I renamed the right file. Renamed passwd to passwd.back, a new file was then generated passwd. Did the restart and it won't allow me access. What could the symbolic link be you mentioned?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Do you have another authentication method configured, such as SSO or SAML? If these are enabled, you need to disable them for the local passwords to be used.

0 Karma

jkat54
SplunkTrust
SplunkTrust

@esix is right. Do you have local authentication disabled?

/Applications/splunk/bin/splunk btool authentication list --debug

0 Karma

dannyze
Explorer

So once I get to the btool file in the bin, what would I need to do?

0 Karma

jkat54
SplunkTrust
SplunkTrust

That whole line is a command you can run to show what type of authentication you have setup. Post the outputp

0 Karma

dannyze
Explorer

Thank you, this was the output
authType = Splunk
passwordHashAlgorithm = SHA512-crypt
[cacheTiming]
getUserInfoTTL = 10s
getUsersTTL = 10s
userLoginTTL = 0
[secrets]
filename =
namespace = splunk

0 Karma

ddrillic
Ultra Champion

Google says - alt text

Did you restart splunk?

0 Karma

dannyze
Explorer

I did do ./splunk restart. No luck.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...