On a new Splunk Forwarder installation the Command Line Interface doesn't work when login authentication is needed

[thomasaross]

This is on a new installation. Linux OS. The install and setup went smoothly enough and using some canned config files (i.e inputs.conf) everything seems to be working (forwarding and indexing). The problem is using the CLI on the forwarder. As the user "splunk" when I exercise the CLI, I get different results. Some commands (the cheap ones like "./splunk help commands") work. Those that require authentication like "./splunk show server name" responds with "Your session is invalid. Please login." The login always fails despite using the correct username/password. Any ideas as to cause or correction?

[lguinn2]

I don't mean to be a jerk, but my bet is that your user name or password is invalid.
Did you change the admin password on the forwarder?

If not, the default user name is admin and the default password is changeme.
You really don't need any other Splunk user on your forwarder except admin.

[thomasaross]

Thanks but I (we) did change the admin password and it does work from the web console. Right now, because it says "...session invalid" it seems to not recognize the "splunk" user, so I believe it isn't a password problem by itself.