Deployment Architecture

On a new Splunk Forwarder installation the Command Line Interface doesn't work when login authentication is needed

New Member

This is on a new installation. Linux OS. The install and setup went smoothly enough and using some canned config files (i.e inputs.conf) everything seems to be working (forwarding and indexing). The problem is using the CLI on the forwarder. As the user "splunk" when I exercise the CLI, I get different results. Some commands (the cheap ones like "./splunk help commands") work. Those that require authentication like "./splunk show server name" responds with "Your session is invalid. Please login." The login always fails despite using the correct username/password. Any ideas as to cause or correction?

0 Karma


I don't mean to be a jerk, but my bet is that your user name or password is invalid.
Did you change the admin password on the forwarder?

If not, the default user name is admin and the default password is changeme.
You really don't need any other Splunk user on your forwarder except admin.

0 Karma

New Member

Thanks but I (we) did change the admin password and it does work from the web console. Right now, because it says "...session invalid" it seems to not recognize the "splunk" user, so I believe it isn't a password problem by itself.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...