We are running multi cluster Splunk environment with a few indexers, few search heads, heavy forwarder, etc.
We need to change Splunk admin password and we will be doing it via command line on each server.
Is there any potential problems we should be looking for?
What else should we pay attention to prior making the change?
Thank you in advance!
Are you using any script where the admin password might be hard-coded? Other than that I think you should be good.
@somesoni2, I really hope we don't have any scripts with hard-coded passwords. Thank you for your reply!
There is away of not hard coding user name and password into a script. Its a technique I've used when building servers with Chef (opsCode). Splunk use two files $SPLUNK_HOME/etc/passwd and $SPLUNK_HOME/etc/auth/splunk.secret to secure local accounts.
If you would like to take a look of my chef cookbook it can be found here on github. I originally wrote it for Nordstrom for a 5.x installation. It doesnt quite work since I had to remove any Nordstrom specific, but its a good example.