Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Admin user accout delete on splunk Enterprise ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Admin user accout delete on splunk Enterprise 7.0.1
Hi Splunker
I have a question about splunk Enterprise 7.0.1
For security reason, my customer want to disable or delete admin account(default) ?
Are there people who experienced similar my case?
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have deleted the default admin account many times. First I needed to create a new admin account and then just login with the new admin and remove the old one. As ivanreis said please make sure to re-assign all the knowledge objects of admin to the new user otherwise they will become orphan and you won't be able to use them.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I never experienced this customer request before. You have the option to clone the admin account to a new account. Also is important to highlight that all knowledge objects already created under admin account have to reassigned to this new user.
There is an old topic at splunk answer about the same topic, although it is related with the older Splunk versions, can be applied to your case as well.
https://answers.splunk.com/answers/65221/replacing-splunk-admin-account-with-a-non-standard-admin-ac...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ivanreis
Thank you for your answer . I did clone admin account(default) as spadmin but I can't delete admin account(default) user. 🙂
If you have any others good please let me know
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In this case, my suggestion is to run a new Splunk enterprise installation and when splunk will start for the 1st time, you have to type the new admin user requested by customer, check this doc
https://docs.splunk.com/Documentation/Splunk/7.3.2/Installation/StartSplunkforthefirsttime.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
